We have a Cloud VPS instance at https://prove.wmcloud.org/, which we use to host ProVe (a tool for helping editors improve the references of Wikidata items). We have created the Cloud VPS instance following the guidance in task T408387.

Our intention is to use this Cloud VPS instance to host ProVe and serve Wikidata users via a gadget. Until we get a gadget, we use the JavaScript file located at https://www.wikidata.org/wiki/User:1hangzhao/ProVe.js. Currently, it points to our HPS Cluster at https://kclwqt.sites.er.kcl.ac.uk/. When trying to swap to our new domain, we encountered the following issue:

Connecting to 'https://prove.wmcloud.org/api/items/checkItemStatus?qid=Q42395533' violates the following Content Security Policy directive: "default-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org wikimedia.org". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback. The policy is report-only, so the violation has been logged but no further action has been taken.

We followed the instructions from Wikitech to open the DNS and port for API access, and it works when accessed externally via https://prove.wmcloud.org/apidocs. However, when accessing directly from Wikidata's page, this CSP issue occurs.

Upon reaching out via the #wikimedia-cloud libera.cat, we received the following instruction:

[16:45:02] <bd808> NathanGavenski: there are browser add-ons that can change the CSP protection locally for you. When you use a tool like that you are exposing your web application use to risks that the app authors wanted to protect you from (3rd party content interaction).

However, this doesn't work since the idea is for the user to import ProVe in their common.js file and use it as a gadget on Wikidata items.

Is there anything I can do on my end to prevent the CSP violation? Or is this a Wikidata directive?