Images rendered by a custom widget are blocked by the Content-Security-Policy directive because their URLs are resolved via the WebServerUrls domains in a load-balanced environment.

For a site hosted in Azure after a restart, browsing the public site at https://site.com causes unexpected redirects to the internal domain https://server1.com 

The issue is commonly observed at the Home page of the site.

The page output which includes the domains and urls displayed by widgets is cached with the wrong domains (used only for internal NLB communication or to achieve site security via reverse proxy).

For example if images in a page are displayed with the domain name of the internal server the cause is a combination of the following factors:
1. The widget code resolves the image URLs as absolute
2. There is no varyByHost caching profile setting configured
3. Sitefinity pings each server using the internal domain URLs from the settings as part of its System Status dashboard health checks

All of the above results in the root page being cached with the wrong domain due to the domain used for the health checks and then, the same cached output item is served regardless of the domain the page is accessed with on the frontend.

Add varyByHost to the caching profile. This will serve the correctly cached version of the page depending on the domain used to access the page. 

Step 1: Go to Administration -> Settings -> Advanced -> System -> Output cache settings and check what is the default cache profile
 

If the cache profile is Standard Caching navigate to Administration -> Settings -> Advanced -> System -> Output cache settings -> Page Cache Profiles -> Standard Caching -> parameters and click Create new, fill in with

Key: varyByHost
Value: true

and save changes

Step 2: restart Sitefinity 

Update the code for all widgets to ensure image URLs are resolved as relative. This will always load them using the current (public) domain on the frontend: Generate relative URLs for related images in MVC Views