Content Security Policy (CSP) trouble
- caught-in-a-nette
- Member | 19
This app has been progressing well over the time. I have forms that
get/update/insert/delete from the database fine; javascript that make the user
experience better; translation of languages support and other features are used.
In the neon configuration files I have also added some neat features.
A while back, I incorporated CSP to use a nonce for scripts, etc.
Recently I being encountering some issues where some scripts are not functioning. They are no longer being loaded. (browser console: Refused to load …js because it does not appear in the script-src directive of the Content Security Policy.)
I basically understand CSP and know script (and styles, etc.) can be
controlled by their settings. However I try to make many additions and changes
but the header is basically the same (Content-Security-Policy: script-src
‘nonce-xyz’ ‘strict-dynamic’;). Which is the standard for employing
version 3. And I have n:nonce
in all my latte script tags.
(My latest neon configuration:)
http:
csp:
script-src: [
nonce # for browsers that support CSP2
self, unsafe-inline # for browsers that support CSP1
]
frame-ancestors: none
form-action: self
style-src:
- self
- https://cdn.example.com
(prior to these defaults, I tried added other domains, etc).
Instead of including each file I have in BootStrap.php:
$files = glob($appDir . '/config/*.neon', GLOB_NOSORT);
foreach ($files as $file) {
$configurator->addConfig($file);
}
My changes seem to make no difference. Is there another location of the CSP
configuration?
(At one point, last week, the main pages loaded OK with no browser js errors,
however sub pages presented CSP errors.)
It seems there's some interference. Please help.
- caught-in-a-nette
- Member | 19
It is definitely in Development mode – I always see the Tracy bar.
(I configured debug mode for all 192.168.1/24 addresses.)
Also (even though it no needed) I often do rm -rf temp/cache
.
Sometimes I even flush the op_cache.
ATM I used Chrome to test javascript since I have installed a Chrome extension to disable CSP with a switch. Safari – my main browser – is used to test the php.
(I've read a few of your articles on CSP configuration.)
I'll try the code for Bootstrap.php & index.php and see if any changes.
- caught-in-a-nette
- Member | 19
@David Grudl
When I set as per the code in your 1st link, in Bootstrap.php &
index.php, I got the following error:
App\Bootstrap::bootWebApplication(): Return value must be of type
App\Nette\DI\Container, Container_a60adf3baa returned
So I commented-out the return type (next to function name, available from
PHP 7, I think). And the app worked OK.
So I guess the return type is wrong but dunno what to make it. (Please have
that page fixed.). BTW I'm using PHP 8.3.
Anyway I'm still having the same CSP problem.
- caught-in-a-nette
- Member | 19
For some unknown reason, probably while testing something, I set a block
code to generate a random nonce and set the cap header.
Removed it and all is working as it should.