Amap Content Security Policy
A short guide to implementing Content Security Policy (CSP) for web apps using Amap. Includes a tested CSP configuration and notes on privacy-conscious domain filtering.
While developing a web app that uses an API from the Chinese map provider Amap (by AutoNavi), I was confused by the lack of documentation regarding their domains that should be allowed under the Content Security Policy. Other blogs I found online either contained outdated information or suggested not using CSP at all. Therefore, I decided to create my own CSP and publish it here for other developers who might face the same issue.
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://webapi.amap.com; style-src 'self' 'unsafe-inline'; img-src 'self' https://webapi.amap.com https://vdata.amap.com https://*.is.autonavi.com; frame-ancestors 'none'; worker-src blob:; connect-src 'self' https://*.amap.comAdditionally, I discovered that Amap attempts to load a suspicious script from https://restapi.amap.com/v3/log/init. Based on its URI, this is likely a tracker. There are also several suspicious empty images being loaded from some endpoints. For privacy reasons, I have excluded all of these from the CSP above.
