https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

• Content Security Policy
  The server supplies headers that indicate the type of content that a page, and its embedded resources, are likely to supply.

Instructions for testing (on Karaf, EAP, and Spring Boot):

• Check the following header is being set in all requests:

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self'; frame-src 'self'

• Check the browser console doesn't have any error messages mentioning Content Security Policy.
• Do a quick smoke test.