CODEWITHSUNDEEP
javascripthttpsecuritycontent-security-policy
R.J. Robinson
R.J. Robinson

Reputation: 2240

CSP Configuration not allowing for proper loading of assets

I am having an issue with configuration here. Im trying to apply an accurate CSP policy, and it keeps throwing errors when trying to load my react app.

My CSP Policy

"script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' https://staging.example.org staging.example.org example.org *.example.org *.gstatic.com *.googleapis.com *.google.com *.amazonaws.com *.myservice.io google-analytics.com *.google-analytics.com *.algolianet.com algolianet.com algolia.net *.algolia.net http: https:;
object-src 'none';
base-uri example.org *.example.org;
require-trusted-types-for 'script';
report-uri 'none';
font-src https://staging.example.org staging.example.org example.org *.example.org *.gstatic.com *.googleapis.com *.google.com *.amazonaws.com *.myservice.io google-analytics.com *.google-analytics.com *.algolianet.com algolianet.com algolia.net *.algolia.net;
manifest-src 'self' https://staging.example.org staging.example.org example.org *.example.org *.gstatic.com *.googleapis.com *.google.com *.amazonaws.com *.myservice.io google-analytics.com *.google-analytics.com *.algolianet.com algolianet.com algolia.net *.algolia.net"

The Error

Refused to load the script 'https://staging.example.org/static/js/2.d7.chunk.js' because it violates the following Content Security Policy directive: "script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' {... } 'strict-dynamic' is present, so host-based allowlisting is disabled. Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

I have tried to set script-src-elem to example.org and the many variations that I have applied above, but I am still being met with this error.

note: its not example.org, just replacing my website.

Upvotes: 0

Views: 906

Answers (1)

granty
granty

Reputation: 8496

'strict-dynamic' cancells all host based sources (http: https: inclusive). Therefore you nedd to allow these sources by the 'nonce' token:

<script src="https://staging.example.org/static/js/2.d7.chunk.js" nonce="rAnd0m123">

as all inline <scrpt> blocks (because 'strict-dynamic' cancells 'unsafe-inline' token too):

<script nonce="rAnd0m123">
   // some code here
</scrpt>

Also the report-uri does not support 'none' token, so directive will be ignored.

And you have some extra:

  • staging.example.org host-source is covered by *.example.org in the font-src/script-src/manifest-src directives
  • https://staging.example.org: is covered by https: in the script-src directive
  • http: https: alltogether covers any host-based sources (except sources which use ws: or wss:)

Upvotes: 1

Related Questions