Content Security Policy (CSP) trouble

caught-in-a-nette
Member | 19
+
0
-

This app has been progressing well over the time. I have forms that get/update/insert/delete from the database fine; javascript that make the user experience better; translation of languages support and other features are used. In the neon configuration files I have also added some neat features.
A while back, I incorporated CSP to use a nonce for scripts, etc.

Recently I being encountering some issues where some scripts are not functioning. They are no longer being loaded. (browser console: Refused to load …js because it does not appear in the script-src directive of the Content Security Policy.)

I basically understand CSP and know script (and styles, etc.) can be controlled by their settings. However I try to make many additions and changes but the header is basically the same (Content-Security-Policy: script-src ‘nonce-xyz’ ‘strict-dynamic’;). Which is the standard for employing version 3. And I have n:nonce in all my latte script tags.

(My latest neon configuration:)

http:
	csp:
		script-src: [
			nonce                 # for browsers that support CSP2
			self, unsafe-inline   # for browsers that support CSP1
		]
		frame-ancestors: none
		form-action: self
		style-src:
			- self
			- https://cdn.example.com

(prior to these defaults, I tried added other domains, etc).
Instead of including each file I have in BootStrap.php:

$files = glob($appDir . '/config/*.neon', GLOB_NOSORT);
foreach ($files as $file) {
	$configurator->addConfig($file);
}

My changes seem to make no difference. Is there another location of the CSP configuration?
(At one point, last week, the main pages loaded OK with no browser js errors, however sub pages presented CSP errors.)
It seems there's some interference. Please help.

David Grudl
Nette Core | 8227
+
0
-

Are you making changes on a live server in production mode?

caught-in-a-nette
Member | 19
+
0
-

It is definitely in Development mode – I always see the Tracy bar. (I configured debug mode for all 192.168.1/24 addresses.)
Also (even though it no needed) I often do rm -rf temp/cache. Sometimes I even flush the op_cache.

ATM I used Chrome to test javascript since I have installed a Chrome extension to disable CSP with a switch. Safari – my main browser – is used to test the php.

(I've read a few of your articles on CSP configuration.)

I'll try the code for Bootstrap.php & index.php and see if any changes.

caught-in-a-nette
Member | 19
+
0
-

@David Grudl

When I set as per the code in your 1st link, in Bootstrap.php & index.php, I got the following error:
App\Bootstrap::bootWebApplication(): Return value must be of type App\Nette\DI\Container, Container_a60adf3baa returned

So I commented-out the return type (next to function name, available from PHP 7, I think). And the app worked OK.
So I guess the return type is wrong but dunno what to make it. (Please have that page fixed.). BTW I'm using PHP 8.3.

Anyway I'm still having the same CSP problem.

caught-in-a-nette
Member | 19
+
0
-

For some unknown reason, probably while testing something, I set a block code to generate a random nonce and set the cap header.
Removed it and all is working as it should.