We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this:

base-uri 'self'; child-src 'self'; form-action 'self'; frame-ancestors 'self'; connect-src 'self'; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' http://www.google-analytics.com https://www.google-analytics.com https://ssl.google-analytics.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' http://www.google-analytics.com https://ssl.google-analytics.com; style-src 'unsafe-inline' 'unsafe-eval' 'self'; default-src ASTERISK;

Recently we got a CSP violation which is -

<CR>csp-report:<CR> Referrer: <CR> Blocked Content Source: ms-appx-web://<CR> Violated Directive: font-src 'self' https://fonts.gstatic.com<CR> Effective Directive: font-src<CR> Status Code: 200<CR>

Can someone help me understand what is ms-appx-web and why did it come out to be the blocked content? Why does the CSP say that font-src is violated?

I have the below understanding -

Allowed fonts are the ones which are inside the application- "SELF" and from "https://fonts-gstatic.com" .. for some reason the user tried to attach a pdf document having a font not supported by application/google fonts. That font may be defined in windows i.e. ms-appx-web://

Is the above correct?

1 Answer 1


ms-appx-web:// is an internal scheme of Edge for browser plugins, it's not a subject of CSP regulation. It's just an error in some Edge version or in the some plugin/extension.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .