Currently, you can allowlist origins that have the following schemes: blob, filesystem, https, and extension. The host part of the origin must explicitly be specified for the https and extension schemes. Generic wildcards such as https:, https://* and https://*.com aren't allowed; subdomain wildcards such as https://*.example.com are allowed. Domains in the are also viewed as generic top-level domains. To load a resource from these domains, the subdomain must explicitly be listed. For example, https://*.cloudfront.net is not valid, but https://XXXX.cloudfront.net and https://*.XXXX.cloudfront.net can be allowlisted., To mitigate a large class of potential cross-site scripting issues, the Microsoft Edge extension system incorporates Content Security Policy (CSP). CSP introduces some strict policies that make extensions more secure by default, and provides you with the ability to create and enforce rules governing the types of content that can be loaded and , The Comptroller Services Portal (CSP) is the Air Force’s 21st century solution for finance customer service. The CSP streamlines the customer experience and enables collaboration at the base level to elevate critical cases and ensure timely resolution..