Same host, different paths
Both buttons connect to this very same origin. Only the path differs.
🛡️ The list permits
/assets/* and /connection-allowlist/api/v1/*, and nothing else.
/api/v1/orders/ matches. /api/collect/ is the same host, same
scheme, same port — and is refused, because its path is not under /v1/.
Note that this page's own stylesheet and scripts load only because /assets/*
is on the list too.
Why this one matters
A CSP connect-src https://demo.report-uri.com permits every path this host serves.
If a vendor is on your list for one API, they are on your list for whichever other endpoint an
attacker finds most convenient — and so is anyone who can get code running on your page.
Destinations in a Connection Allowlist are URL patterns, so the allowance stops at the endpoint you actually meant.
Connection Allowlist header sent with this page
Connection-Allowlist: ("https://report-uri-demo.com/assets/*" "https://report-uri-demo.com/connection-allowlist/api/v1/*"); report-to=default