diff --git a/app-config.production.yaml b/app-config.production.yaml
index 2944d96..e984a56 100644
--- a/app-config.production.yaml
+++ b/app-config.production.yaml
@@ -9,6 +9,9 @@ backend:
   baseUrl: http://backstage.rber.bj
   listen:
     port: 7007
+  csp:
+    connect-src: ["'self'", "http:", "https:"]
+    upgrade-insecure-requests: false
   cors:
     origin: http://backstage.rber.bj