content-security-policy

Cordova deviceready not firing in iOS until interacting with iOS

由 主宰稳场 提交于 2019-11-30 12:50:40
I had a really weird bug where deviceready event would not fire in an iOS device until the user interacted with the OS itself, this is, pressing the front button, show the notification center with drag down or go to device settings dragging up. As soon as the user started dragging the iOS notification center, then deviceready fired. Something as simple as this would just not work: <!DOCTYPE html> <html> <head> <meta charset="utf-8" /> <meta name="viewport" content="initial-scale=1, maximum-scale=1, user-scalable=no, width=device-width" /> <meta http-equiv="Content-Security-Policy" content=

Modernizr Causes Content Security Policy (CSP) Violation Errors

由 痞子三分冷 提交于 2019-11-30 11:49:48
问题 I am attempting to use the new Content Security Policy (CSP) HTTP headers on a test site. When I use CSP in conjunction with Modernizr I get CSP violation errors. This is the CSP policy I am using: Content-Security-Policy: default-src 'self'; script-src 'self' ajax.googleapis.com ajax.aspnetcdn.com; style-src 'self'; img-src 'self'; font-src 'self'; report-uri /WebResource.axd?cspReport=true These are the errors from the Chrome browser console: Refused to apply inline style because it

How to detect Content Security Policy (CSP)

由 心已入冬 提交于 2019-11-30 11:06:01
I noticed that GitHub and Facebook are both implementing this policy now, which restricts third party scripts from being run within their experience/site. Is there a way to detect whether a document is running against CSP using JavaScript ? I'm writing a bookmarklet, and want to give the user a message if they're on a site that doesn't support embedding a script tag. What about this. For slow connections, the timeout should probably be raised. Onload is what I used to detect it and it seems to work. If it loads then CSP obviously isn't enabled or it is configured improperly. var CSP = 0; frame

How can I allow Mixed contents (http with https) using content-security-policy meta tag?

由 对着背影说爱祢 提交于 2019-11-30 07:08:15
问题 I'm forcing https to access my website, but some of the contents must be loaded over http (for example video contents can not be over https), but the browsers block the request because of mixed-contents policy. After hours of searching I found that I can use Content-Security-Policy but I have no idea how to allow mixed contents with it. <meta http-equiv="Content-Security-Policy" content="????"> 回答1: You can't. CSP is there to restrict content on your website, not to loosen browser

Chrome extension \"Refused to evaluate a string as JavaScript because 'unsafe-eval'

由 有些话、适合烂在心里 提交于 2019-11-30 06:34:12
I have an error: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:" . Either the 'unsafe-inline' keyword, a hash ( 'sha256-...' ), or a nonce ( 'nonce-...' ) is required to enable inline execution. chrome-extension://ldbpohccneabbobcklhiakmbhoblcpof/popup.html:1 Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:" . the code popup.js $(document).ready

Content Security Policy in Chrome App

由 元气小坏坏 提交于 2019-11-30 04:19:25
My Chrome app has the following manifest: { "name": ", "version": "1.0.3", "manifest_version": 2, "description": "Chrome Extension for.", "icons": { "16": "images/test.png", "19": "images/test.png", "256": "images/test.png" }, "app": { "background": { "scripts": [ "background.js" ] } }, "sandbox": { "js": [ "lib/test-api.js" ] }, "permissions": [ "<all_urls>", "notifications", "storage", "videoCapture" ] } I have a script file that runs eval . I have read about CSP and sandboxing, but I still get this error: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed

Modernizr Causes Content Security Policy (CSP) Violation Errors

由 那年仲夏 提交于 2019-11-30 01:56:11
I am attempting to use the new Content Security Policy (CSP) HTTP headers on a test site. When I use CSP in conjunction with Modernizr I get CSP violation errors. This is the CSP policy I am using: Content-Security-Policy: default-src 'self'; script-src 'self' ajax.googleapis.com ajax.aspnetcdn.com; style-src 'self'; img-src 'self'; font-src 'self'; report-uri /WebResource.axd?cspReport=true These are the errors from the Chrome browser console: Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline'

Content security policy including a script

由 五迷三道 提交于 2019-11-30 00:16:21
问题 I need to include this script https://apis.google.com/js/api:client.js in my website. On Google Chrome it works fine, but on Firefox (and IE obviously), I get some errors: Content Security Policy: Ignoring “‘unsafe-inline’” within script-src: ‘strict-dynamic’ specified Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified I tried to change the content security policy

Cordova deviceready not firing in iOS until interacting with iOS

由 岁酱吖の 提交于 2019-11-29 17:59:49
问题 I had a really weird bug where deviceready event would not fire in an iOS device until the user interacted with the OS itself, this is, pressing the front button, show the notification center with drag down or go to device settings dragging up. As soon as the user started dragging the iOS notification center, then deviceready fired. Something as simple as this would just not work: <!DOCTYPE html> <html> <head> <meta charset="utf-8" /> <meta name="viewport" content="initial-scale=1, maximum

Does Content Security Policy block bookmarklets?

由 本秂侑毒 提交于 2019-11-29 16:40:50
问题 Does Mozillas CSP block to execute Javascript from a bookmark by default? Can it be configured to do so? 回答1: As of 2017, the answer is still a definitive "maybe" - just like when this answer was originally posted in 2011. The specification clearly says: Policy enforced on a resource SHOULD NOT interfere with the operation of user-agent features like addons, extensions, or bookmarklets. And this is indeed the behavior I see in Chrome 61: a bookmarklet will run on https://addons.mozilla.org/,
订阅 content-security-policy