CODEWITHSUNDEEP
javascriptgoogle-chromemicrosoft-edgecontent-security-policybrowser-cache
Jacob Chmielowiec
Jacob Chmielowiec

Reputation: 133

CSP issue on cold load with chrome and Edge but works on refresh. Firefox also always works fine

My Context:

I'm working on a static page served by AWS CloudFront and stored in S3. The page is basic html, css, and js. No frameworks. CSP is implemented with hashes since using nonces is not possible on my static site.

My Problem:

The page loads without issue on Firefox. On Chrome and Edge, I get a CSP error on a umd library inlined by vite (<script inline-source type="application/javascript" src="./js/PageConfiguration.umd.js"></script>) during my build using vite-plugin-inline-source but it loads normally if I refresh.
The Error: Refused to execute inline script because it violates the following Content Security Policy directive:

My Investigation:

The site is static and I double checked with a diff tool to verify the code is identical on the initial load with the csp error and the subsequent loads that work.

The csp header is also identical.

Next Steps?

Given the above, I don't even know how to proceed. Is this a bug with the chromium engine? Is there a way that I could get a legitimate CSP error even though the correct hash is included in the header? Why would it fail on the initial load (or when the cache is disabled) but not on subsequent loads? Why does it always work on Firefox? It seems like either Firefox is failing to identify a CSP risk, or (more likely in my estimation) Chrome is generating a false positive.

I'm currently experimenting with different configurations to see if I can eliminate the issue but have had no luck.

I would love to understand what is going on here.

My Temporary Workaround:

Check to see if the script loaded. If the typeof is undefined I know that it didn't initialize and I can then force a refresh. I hate this solution but it will have to work until I can understand the problem better.

Upvotes: 1

Views: 56

Answers (1)

Kendrick Li
Kendrick Li

Reputation: 3106

It looks like a new issue in recent versions of Chrome and Edge, and I have found a similar report in Chromium Issues. You can report your issue there and see the next steps by Chromium Dev Team.

Upvotes: 1

Related Questions