URL: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResou...
Submission: On August 02 via manual — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 198.204.184.151, located in United States and belongs to FANNIEMAE, US. The main domain is fmsso.fanniemae.com. The Cisco Umbrella rank of the primary domain is 618378.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on March 22nd 2024. Valid for: a year.
This is the only time fmsso.fanniemae.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 198.204.184.151 11313 (FANNIEMAE)
4 1
Apex Domain
Subdomains
Transfer
4 fanniemae.com
fmsso.fanniemae.com — Cisco Umbrella Rank: 618378
243 KB
4 1
Domain Requested by
4 fmsso.fanniemae.com fmsso.fanniemae.com
4 1

This site contains links to these domains. Also see Links.

Domain
passwordreset.fanniemae.com
Subject Issuer Validity Valid
fmsso.fanniemae.com
Sectigo RSA Organization Validation Secure Server CA
2024-03-22 -
2025-03-22
a year crt.sh

This page contains 1 frames:

Primary Page: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
Frame ID: 85BF108EA8A5B1C357B52E053549E285
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Fannie Mae Authentication & Authorization Services - Central Login

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

243 kB
Transfer

234 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request startSSO.ping
fmsso.fanniemae.com/idp/
12 KB
14 KB
Document
General
Full URL
https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.204.184.151 , United States, ASN11313 (FANNIEMAE, US),
Reverse DNS
dc2-fmsso-cert-auth-ext.fanniemae.com
Software
/
Resource Hash
95b400dd9ddae52e2a9c625d0028314f873180577d175527258dc8e8635847d6
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
Keep-Alive
Content-Length
12565
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Content-Type
text/html;charset=utf-8
Date
Fri, 02 Aug 2024 09:38:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive
timeout=15, max=1000
Pragma
no-cache
Strict-Transport-Security
max-age=31536000
X-Frame-Options
SAMEORIGIN
main.css
fmsso.fanniemae.com/assets/css/
173 KB
175 KB
Stylesheet
General
Full URL
https://fmsso.fanniemae.com/assets/css/main.css
Requested by
Host: fmsso.fanniemae.com
URL: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.204.184.151 , United States, ASN11313 (FANNIEMAE, US),
Reverse DNS
dc2-fmsso-cert-auth-ext.fanniemae.com
Software
/
Resource Hash
b78f5ace3ab01e920e71f071bf2f4fd9dec0b31c83e5492b0d54101d563105e8
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 02 Aug 2024 09:38:04 GMT
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Last-Modified
Sat, 27 Jul 2024 01:40:18 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=15, max=999
Content-Length
177336
white_fm_logo.png
fmsso.fanniemae.com/assets/images/
3 KB
5 KB
Image
General
Full URL
https://fmsso.fanniemae.com/assets/images/white_fm_logo.png
Requested by
Host: fmsso.fanniemae.com
URL: https://fmsso.fanniemae.com/assets/css/main.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.204.184.151 , United States, ASN11313 (FANNIEMAE, US),
Reverse DNS
dc2-fmsso-cert-auth-ext.fanniemae.com
Software
/
Resource Hash
ab8d49cc7c8faf48a4e8080b635fb8a0a93f8190fac15207852ebc6ae95122ce
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://fmsso.fanniemae.com/assets/css/main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 02 Aug 2024 09:38:04 GMT
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Last-Modified
Sat, 27 Jul 2024 01:40:18 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=15, max=998
Content-Length
2825
favicon.ico
fmsso.fanniemae.com/assets/images/
46 KB
48 KB
Other
General
Full URL
https://fmsso.fanniemae.com/assets/images/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.204.184.151 , United States, ASN11313 (FANNIEMAE, US),
Reverse DNS
dc2-fmsso-cert-auth-ext.fanniemae.com
Software
/
Resource Hash
84a2de7039ab4db56b2463fe5e631069e65b734f4341a46c5ad9eaf0dc7ba837
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 02 Aug 2024 09:38:04 GMT
Strict-Transport-Security
max-age=31536000
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Last-Modified
Sat, 27 Jul 2024 01:40:18 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
image/x-icon
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=15, max=997
Content-Length
46871

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| postForgotPassword function| postRecoverUsername function| postAlternateAuthnSystem function| postRegistration function| postOk function| submitForm function| postCancel function| postOnReturn function| setFocus function| setMobile function| getScreenWidth object| bodyTag number| width function| show function| hide function| checkForm

4 Cookies

Domain/Path Name / Value
fmsso.fanniemae.com/ Name: PF
Value: 8JlBKVvX4q1CrvcT6mt5O5
fmsso.fanniemae.com/ Name: AWSALB
Value: ga4mboPGnuH4E78bvfk+GRceg50NfzhwBy0NFEknGC/nMjbAR7zJqxG3zzx/gfoLxGXir7DhlQV9VMUy5YTbYGe6Maszjskc6mvVNfJdAdNbFYUBmL2HswampSSs
fmsso.fanniemae.com/ Name: AWSALBCORS
Value: ga4mboPGnuH4E78bvfk+GRceg50NfzhwBy0NFEknGC/nMjbAR7zJqxG3zzx/gfoLxGXir7DhlQV9VMUy5YTbYGe6Maszjskc6mvVNfJdAdNbFYUBmL2HswampSSs
fmsso.fanniemae.com/ Name: TS011b459c
Value: 01cacfc69aeb9e588689b1f78ed4de89413c29862c0e660c69311f718ab912b9ccd6471390a12b65478a84696c0492497daa091f5ddf7d2bafe49cd035de628ff346c79073f0fcd1c6747a22f5eb00af6ac3af2d08afe649921791c00ced58f0806b43ea08

3 Console Messages

Source Level URL
Text
security error URL: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h(Line 96)
Message:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com". Either the 'unsafe-inline' keyword, a hash ('sha256-QwYvo//H30V6P0IDawhX5hV8quJwcTI3MYE5eO+6qig='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
security error URL: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h(Line 130)
Message:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com". Either the 'unsafe-inline' keyword, a hash ('sha256-sw+WhePPvBkX2w0L1Zp/3ogn7oJiBO3PyTWDV0eEQzM='), or a nonce ('nonce-...') is required to enable inline execution.
recommendation verbose URL: https://fmsso.fanniemae.com/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Fsso-p2p-FFH-p1-saml-FNMInvoicingExternal&TargetResource=https://fanniemae-singlefamily.my.site.com/00O3w0000068I7h
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; img-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png data: https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; style-src 'self' https://*.fanniemae.com/pa/oidc/logout.png https://*.fanniemae.com:*/pa/oidc/logout.png https://*.efanniemae.com/pa/oidc/logout.png https://*.efanniemae.com:*/pa/oidc/logout.png https://assets.pingone.com/davinci/latest/davinci.js https://fonts.googleapis.com ; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://singlefamily-fanniemae.my.salesforce.com https://singlefamily-fanniemae.lightning.force.com https://fanniemae.service-now.com https://connect.fanniemae.com https://fry.fmconnect.sfdl.prod.fanniemae.com https://fry.cdxms.prod-etss.aws.fanniemae.com https://fmconnect.fanniemae.com https://enterpriseriskmanagement.my.salesforce.com https://enterpriseriskmanagement.lightning.force.com ;
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN