APM CSP header insertion - Rewrite profile

Hi all,

 

I have noticed a strange thing: The APM inserts a CSP header with all the domains that configured in the bypass list in the rewrite profile.

 

This is the header that inserted by the APM: Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' ws: wss: jar: data: blob: mediasource: mediastream: https: http://www.femoer.com http://www.shar.com/ http://www.well.net;

 

I tried to add a the "; domain just for checking and the APM added this domain in the CSP header.

 

Someone can explain how those two thing are connected ?