How to render images from Magnolia CMS on Salesforce Community?

Question

I was able to render Text contents from Magnolia public REST API on Salesforce community.

ISSUE: Image files are being blocked by CSP (Content Security Policy)

TRIED: Added the Base URL a few different ways to in Site URL in CSP Trusted Sites

    https://*.magnolia-cms.com
    https://*.demopublic.magnolia-cms.com
    https://demopublic.magnolia-cms.com

   Also, included https://demopublic.magnolia-cms.com url in Trusted Sites for Script

What I am missing here?

Answer 1

That looks like a typical case of forgetting setting the CORS headers on Magnolia site, hence browser blocking the request as required by the spec:

For security reasons, browsers restrict cross-origin HTTP requests initiated from scripts. For example, XMLHttpRequest and the Fetch API follow the same-origin policy. This means that a web application using those APIs can only request resources from the same origin the application was loaded from unless the response from other origins includes the right CORS headers.

More details here

If you haven't done so before, you can add simple static CORS definition in headers using AddHeadersFilter. It was discussed previously eg here