I've been successfully using the DNQuery control on legacy forms for years.

Now, on a fresh IDM 4.10.0 a simple test form that worked correctly on 4.8.7 fails:

Clicking on the control shows the expected query results, however none of the displayed matches can be selected.

Looking at the form debugger this issue seems to result from a security setting (Content Security Policy) that prevents loading/executing the needed scripts. I'm getting the error

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self'”

The response headers confirm this CSP:

Now, my question: is this an IDM 4.10.0 bug and/or something that I need to fix on my side, e.g., by using some Tomcat (httpHeaderSecurity) filter in web.xml?

Thx