Content Security Policy: The page's settings blocked - content-security-policy

Hi I am facing issue related to CSP.
I am getting following error message in my firefox browser.
Content Security Policy: The page's settings blocked the loading of a resource at http://www.gstatic.com/charts/geomap/3//geomap.swf ("object-src http://localhost:8080").
How can I solve this issue?
Thanks in advance

Add http://localhost:8080 to your object-src directive or add object-src http://localhost:8080 to your policy. (It'd be helpful if you provided your CSP)

Related

Callback violates CSP policy even though it is referenced in 'script-src' policy

Im getting a CSP violation in chrome console:
Refused to load the script 'https://ipinfo.io/?callback=jQuery....' because it violates the following Content Security Policy directive
even though ipinfo.io is included the policy.
script-src 'self' *.ipinfo.io;
Any ideas why ?
could it be because its a callback and not a static script ? could this be solved ?
but you allowed only subdomains, not your main domain.
*.ipinfo.io allows everything which is foobar.ipinfo.io but not the main Domain it self, you need to add it as well

Refused to frame ‘https://my.matterport.com/’ because an ancestor violates the following Content Security Policy directive: “frame-ancestors ‘self’”

I’m trying to add Content Security Policy to my Gatsby x Netlify website through a _headers file. Everything works fine, except for a Matterport iFrame that doesn’t want to be displayed. The error message I see in the console is
Refused to frame 'https://my.matterport.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".
In my headers file, I added the following X-Frame-Options:
X-Frame-Options: ALLOW-FROM https://*.matterport.com/
And I also have this frame-src in my Content Security Policy:
frame-src 'self' https://www.youtube.com/ https://my.matterport.com https://matterport.com;
But the iFrames still look like this:
Matterport iFrames not displaying
Can someone help me figure out what I’m doing wrong here?
Thank you!
I recently came accross the same error message and corrected this by removing a double forward slash before the video link, my original iFrame inclusion looked like: https://my.matterport.com/show//?m=XXXXXXX replacing this with https://my.matterport.com/show/?m=XXXXXXX was enough to get the iFrame showing again.

Adsense sometimes doesn't serve ads because of Content Security Policy

I recently added Google AdSense to my website and the ads works fine, expect sometimes they don't load and I get the following errors in the console
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://cdn.ampproject.org/". Either the 'unsafe-inline' keyword, a hash ('sha256-xxx'), or a nonce ('nonce-...') is required to enable inline execution.
From what I've read I need to added the CSP in my HTML headers, but doesn't seem to fix the problem.
Any tips?
TRY1
This discussion could help to get access to the site with the following snippet:
script-src 'self' http://xxxx 'unsafe-inline' 'unsafe-eval';
TRY2
This documentation will show you how to define the policy with:
Content-Security-Policy: script-src 'self' https://apis.google.com
Hope that will help and you question is answered. Give it a shot, cheers! :)

How to fix "Content Security Policy - contains an invalid source" error?

Im getting this error and I don´t know why, the scripts that I have included works?
And the error only shows up when I load a subpage. Not when I load the startpage.
So what Im I doing wrong?
The source list for Content Security Policy directive 'script-src' contains an invalid source: ''strict-dynamic''. It will be ignored.
<meta http-equiv="Content-Security-Policy" content="script-src * 'unsafe-inline' 'unsafe-eval' https://checkout.dibspayment.eu https://www.google-analytics.com https://maps.google.com;">
Any input really appreciated, thanks.
And the error only shows up when I load a subpage. Im getting this error and I don´t know why
The source list for Content Security Policy directive 'script-src' contains an invalid source: ''strict-dynamic''. It will be ignored.
It's not an error, just a warning that you browser does not support the 'strict-dynamic' token. (guess you use Safari).
I guess that subpage is a some Google's iframe (oAuth2, reCaptcha, etc). That iframe publush it's own CSP wich contains the 'strict-dynamic' token and this CSP was created in browsers backward compatibility mode (Google make such).
That's a warning from third-party CSP, not your's.
the scripts that I have included works?
Your parent page has own CSP which allows scripts. The CSP of nested browsing context (iframe) does not affects parent page (except the frame-ancestors directive).
So what Im I doing wrong?
Nothing. It's an intended regular work of Content Security Policy.
Each browsing context can have its own CSP. But all warns will flow to one browser console, and that is mislead.

I am trying to Understand Content-Security-Policy Frame Ancestors tag

I am trying to display one of my sites in a iframe inside my IONIC app. I need to restrict my website from being iframed by other websites. I decided to go with the content-security-policy response header where
Content-security-policy: frame-ancestors ${website-to-be-allowed}
made sure only the websites mentioned could iframe my website however I needed my ionic app to iframe my website as well and Since Ionic apps are served as file system I am okay with giving access to all file system to iframe my website. When I added
Content-security-policy: frame-ancestors ${website-to-be-allowed} filesystem
as mentioned here,
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
I tested on both my Android and IOS app and both threw the same error saying,
which says,
Refused to display ${website} in a frame because an ancestor violates the following content security policy directive: "frame-ancestors filesystem"
Here is the error that pops up enter image description here
Just for reference I got it working using:
file://* filesystem:
So the overall content security policy could look like this:
Content-Security-Policy: "...; frame-ancestors 'self' file://* filesystem:;
You need the colon at the end of "filesystem". Try
frame-ancestors ${website-to-be-allowed} filesystem:

Resources