Update content-security-policy.md

[daibhin]

Changes

Originally raised in https://posthoghelp.zendesk.com/agent/tickets/16225

Add proxy host to suggested CSP

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
posthog	✅ Ready (Inspect)	Visit Preview	Aug 14, 2024 5:07pm

[daibhin]

@raquelmsmith tagging you two because I saw that you recently changed from internal-e to internal-t. Do you have a good sense if customers should be adding this to their CSP?

[frankh]

this is only used by posthog (the company, as a user of posthog services), so shouldn't be added here - customers should never use this

[daibhin]

It is inadvertently called from a customers site via the toolbar:
https://github.com/PostHog/posthog/blob/00dd4e8028b12e981e7d70d6a2ad05766b6a69db/frontend/src/toolbar/toolbarPosthogJS.ts#L9

Should they need to add it to their CSP in that case?

[daibhin]

Resolved this internally. The toolbar does make calls to internal-t to track it's own events e.g. toolbar loaded. Thinking is this isn't important enough to add it to the general CSP list, especially given people can change the window.JS_POSTHOG_HOST variable to us.i.posthog.com if they want