Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #38996

Re: Chrome and passing on cross-origin

From doctor@doctor.nl2k.ab.ca (The Doctor)
Newsgroups comp.lang.javascript
Subject Re: Chrome and passing on cross-origin
Date 2020-10-19 02:43 +0000
Organization NetKnow News
Message-ID <rmiugt$tod$15@gallifrey.nk.ca> (permalink)
References <rmdmmp$2c5l$3@gallifrey.nk.ca> <b3fa70f0-34f1-40d5-879c-ef3f060e7885n@googlegroups.com> <rmio4g$9lb$12@gallifrey.nk.ca> <90f1d3fd-9971-4273-8463-92ec3b34d18cn@googlegroups.com>

Show all headers | View raw

In article <90f1d3fd-9971-4273-8463-92ec3b34d18cn@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Sunday, October 18, 2020 at 7:54:48 PM UTC-5, The Doctor wrote:
>> In article <b3fa70f0-34f1-40d5...@googlegroups.com>,
>> Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
>> >On Sunday, October 18, 2020 at 5:15:18 PM UTC-5, The Doctor wrote: 
>> > 
>> >> Tried that no dice! 
>> > 
>> >> IS the referrer-policy interfering? 
>> > 
>> >What does "no dice" mean? Did you get a warning/error in your console?
>> No a thing and the referrer-policy is not the issue, the CSP 
>> seems to be the very culprit. 
>> 
>> IF the CSP is turned on then the onbaord embedded javascript 
>> will not turn on!
>
>Yes, as I mentioned earlier. I made a vanilla HTML page in IIS with your
>current security policy and got the mentioned error in the browser
>console:
>
>```xml
><!-- web.config -->
><?xml version="1.0" encoding="utf-8"?>
><configuration>
>    <system.webServer>
>        <httpProtocol>
>            <customHeaders>
>                <add name="Content-Security-Policy" value="default-src
>'self'; script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net; img-src 'self'
>https://ssl.google-analytics.com https://s-static.ak.facebook.com
>https://assets.zendesk.com; style-src 'self'
>https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self'
>https://themes.googleusercontent.com; frame-src
>https://assets.zendesk.com https://www.facebook.com
>https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src
>'none'" />
>            </customHeaders>
>        </httpProtocol>
>    </system.webServer>
></configuration>
>```
>
>```html
><!DOCTYPE html>
><html lang="en-US" dir="ltr">
>    <head>
>        <meta charset="utf-8">
>        <title></title>
>    </head>
>    <body>
>        <script src="https://code.jquery.com/jquery-3.3.1.js"
>           
>integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60="
>crossorigin="anonymous"></script>
>    </body>
></html>
>```
>
>The browser console then reads:
>
>```text
>Refused to load the script 'https://code.jquery.com/jquery-3.3.1.js'
>because it violates the following Content Security Policy directive:
>"script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net". Note that
>'script-src-elem' was not explicitly set, so 'script-src' is used as a
>fallback.
>```
>
>By following my earlier suggestion of adding <https://code.jquery.com>
>to the script-src makes the error go away
>
>```
>script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net
>https://code.jquery.com;
>```

So what would

add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.nk.ca https://secure.nl2k.ab.ca https://code.jquery.com https://ajax.googleapis.com https://cdnjs.cloudflare.com/ https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net https://www3.moneris.com/ ; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' https://cdnjs.cloudflare.com/ https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";


-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 02:59 +0000
  Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-16 21:45 -0700
    Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-17 11:00 +0200
    Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 13:24 +0000
      Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 22:27 +0000
        Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-17 17:30 -0700
          Re: Chrome and passing on cross-origin "J.O. Aho" <user@example.net> - 2020-10-18 16:14 +0200
          Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 10:17 -0700
            Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-18 22:15 +0000
              Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 15:31 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 00:54 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 18:51 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 02:43 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 19:48 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 21:58 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-19 21:11 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 05:04 +0000
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 13:14 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-21 13:59 +0000
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 13:41 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-22 11:46 -0700
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 22:36 +0000
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 02:42 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 14:47 -0700
                Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:05 +0200
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 15:24 -0700
                Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:53 +0200
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 23:42 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 21:19 -0700
                Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 15:33 +0100
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-25 18:49 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-25 12:04 -0700
                Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-26 00:31 +0100
                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-26 00:44 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700

csiph-web