[BUG] Images not rendering on the PLP or PDP when hosted on AWS about pwa-kit

[johnboxall]

Hey @tgrahn2 this is a security feature, not a bug 🔒 🚫 🐛 .

By default, the Retail React App includes helmet Express.js library to add security headers:

pwa-kit/packages/pwa/app/ssr.js

Lines 45 to 60 in 8f12ae8

	// Set HTTP security headers
	app.use(
	helmet({
	contentSecurityPolicy: {
	useDefaults: true,
	directives: {
	'img-src': ["'self'", '*.commercecloud.salesforce.com', 'data:'],
	'script-src': ["'self'", "'unsafe-eval'"],
	// Do not upgrade insecure requests for local development
	'upgrade-insecure-requests': isRemote() ? [] : null
	}
	},
	hsts: isRemote()
	})
	)

To allow images from other domains, you'll need to add them to Content Security Policies' allow list.

If this is for a site under development or POC, you might consider disabling them entirely.

[tgrahn2]

yeah makes sense. Manually changing ssr.js worked. Thanks for the pointer... and I agree, should not be done in production. Thanks for your help @johnboxall