title: "cross domain javascript source file inclusion" reported by OWASP ZAP for trusted resource
body: <p>My host is <code>www.example.com</code> and I'm serving html pages with URL <code>www.example.com/html-url.html</code>.
  In these htmls I have included a javascript file from our S3 bucket say <code>bucket-name</code>.</p>
  <p>The OWASP ZAP scan is raising a low level alert for this - Cross-Domain JavaScript Source File Inclusion
  Evidence: <code>&lt;script src=&quot;bucket-name/custom.js&quot; type=&quot;text/javascript&quot;/&gt;</code></p>
  <p><strong>Question:</strong> Is there any way that I can configure a list of trusted resources/URLs in configuration? I'm using NGINX server.
  Please note that, for some reasons I need to get a clean vulnerability scan report.</p>
  <p>I understand that there is this HTTP header &quot;Content Security Policy&quot; and on the official site it says &quot;Content Security Policy (CSP) is an HTTP header that allows site operators fine-grained control over where resources on their site can be loaded from.&quot;</p>
  <p>But I'm not sure if I can make use of this.</p>