Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #38966 > unrolled thread

Chrome and passing on cross-origin

Back to article view | Back to comp.lang.javascript

Contents

  Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 02:59 +0000
    Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-16 21:45 -0700
      Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-17 11:00 +0200
      Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 13:24 +0000
        Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-17 22:27 +0000
          Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-17 17:30 -0700
            Re: Chrome and passing on cross-origin "J.O. Aho" <user@example.net> - 2020-10-18 16:14 +0200
            Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 10:17 -0700
              Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-18 22:15 +0000
                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 15:31 -0700
                  Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 00:54 +0000
                    Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 18:51 -0700
                      Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 02:43 +0000
                        Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-18 19:48 -0700
                          Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-19 21:58 +0000
                            Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-19 21:11 -0700
                              Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 05:04 +0000
                                Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-20 13:14 +0000
                                  Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700
                                    Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-21 13:59 +0000
                                      Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 13:41 +0000
                                        Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-22 11:46 -0700
                                          Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-22 22:36 +0000
                                            Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 02:42 +0000
                                              Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 14:47 -0700
                                                Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:05 +0200
                                                  Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 15:24 -0700
                                                    Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 00:53 +0200
                                                      Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-24 23:42 +0000
                                                      Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-24 21:19 -0700
                                                        Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-25 15:33 +0100
                                                          Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-25 18:49 +0000
                                                            Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-25 12:04 -0700
                                                              Re: Chrome and passing on cross-origin "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2020-10-26 00:31 +0100
                                                              Re: Chrome and passing on cross-origin doctor@doctor.nl2k.ab.ca (The Doctor) - 2020-10-26 00:44 +0000
                                Re: Chrome and passing on cross-origin "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2020-10-20 09:47 -0700

Page 1 of 2  [1] 2  Next page →

#38966 — Chrome and passing on cross-origin

Anyone familiar with

https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default/

?

I have a php seesion that uses this javascript
snippet

:

<script
  src="https://code.jquery.com/jquery-3.3.1.js"
    integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60="
      crossorigin="anonymous"></script>
      <script>

If I read google developers correctly, I might have to
change this snippet.

What is least path of resistance to accomplish this change?
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [next] | [standalone]

#38967

On Friday, October 16, 2020 at 9:59:47 PM UTC-5, The Doctor wrote:
> Anyone familiar with 
> 
> https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default/ 
> 
> ? 
> 
> I have a php seesion that uses this javascript 
> snippet 
> 
> : 
> 
> <script 
> src="https://code.jquery.com/jquery-3.3.1.js" 
> integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" 
> crossorigin="anonymous"></script> 
> <script> 
> 
> If I read google developers correctly, I might have to 
> change this snippet. 
> 
> What is least path of resistance to accomplish this change? 

Google's update should be irrelevant to you practically.

Though you should define a content security policy for your website.

<https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP>

Test its quality with:

<https://observatory.mozilla.org/>

[toc] | [prev] | [next] | [standalone]

#38968

"Michael Haufe (TNO)" <tno@thenewobjective.com> wrote on 17 Oct 2020 in
comp.lang.javascript: 

> On Friday, October 16, 2020 at 9:59:47 PM UTC-5, The Doctor wrote:
>> Anyone familiar with 
>> 
>> https://developers.google.com/web/updates/2020/07/referrer-policy-new-ch
>> rome-default/ 
>> 
>> ? 
>> 
>> I have a php seesion that uses this javascript 
>> snippet 

php is serverside and doesn't use Javascript.

For the rest I agree with Michael.

>> 
>> : 
>> 
>> <script 

This surely is clientside.

>> src="https://code.jquery.com/jquery-3.3.1.js" 
>> integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" 
>> crossorigin="anonymous"></script> 
>> <script> 
>> 
>> If I read google developers correctly, I might have to 
>> change this snippet. 
>> 
>> What is least path of resistance to accomplish this change? 
> 
> Google's update should be irrelevant to you practically.
> 
> Though you should define a content security policy for your website.
> 
> <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP>
> 
> Test its quality with:
> 
> <https://observatory.mozilla.org/>



-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#38974

In article <b5a88d78-d1a3-43ed-bd88-f538d178c8ean@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Friday, October 16, 2020 at 9:59:47 PM UTC-5, The Doctor wrote:
>> Anyone familiar with 
>> 
>>
>https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default/ 
>> 
>> ? 
>> 
>> I have a php seesion that uses this javascript 
>> snippet 
>> 
>> : 
>> 
>> <script 
>> src="https://code.jquery.com/jquery-3.3.1.js" 
>> integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" 
>> crossorigin="anonymous"></script> 
>> <script> 
>> 
>> If I read google developers correctly, I might have to 
>> change this snippet. 
>> 
>> What is least path of resistance to accomplish this change? 
>
>Google's update should be irrelevant to you practically.
>
>Though you should define a content security policy for your website.
>
><https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP>
>
>Test its quality with:
>
><https://observatory.mozilla.org/>

Will look.
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#38981

In article <rmerb4$30qm$6@gallifrey.nk.ca>,
The Doctor <doctor@doctor.nl2k.ab.ca> wrote:
>In article <b5a88d78-d1a3-43ed-bd88-f538d178c8ean@googlegroups.com>,
>Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>>On Friday, October 16, 2020 at 9:59:47 PM UTC-5, The Doctor wrote:
>>> Anyone familiar with 
>>> 
>>>
>>https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default/ 
>>> 
>>> ? 
>>> 
>>> I have a php seesion that uses this javascript 
>>> snippet 
>>> 
>>> : 
>>> 
>>> <script 
>>> src="https://code.jquery.com/jquery-3.3.1.js" 
>>> integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" 
>>> crossorigin="anonymous"></script> 
>>> <script> 
>>> 
>>> If I read google developers correctly, I might have to 
>>> change this snippet. 
>>> 
>>> What is least path of resistance to accomplish this change? 
>>
>>Google's update should be irrelevant to you practically.
>>
>>Though you should define a content security policy for your website.
>>
>><https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP>
>>
>>Test its quality with:
>>
>><https://observatory.mozilla.org/>
>
>Will look.

Some good hints but no dice on the page yet.

>-- 
>Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
>Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
>Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
>BC save the Province; on 24 October 2020, vote Liberal and not NDP!


-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#38982

On Saturday, October 17, 2020 at 5:27:21 PM UTC-5, The Doctor wrote:

> Some good hints but no dice on the page yet.

What does that mean? Are you getting a warning?

[toc] | [prev] | [next] | [standalone]

#38987

On 18/10/2020 14.37, The Doctor wrote:

> In Firefox, Waterfox, SeaMonkey, Opera and other similar browsers
> 
> if the nginx.conf lines I comment above are turn off, the page
> fails like it does in Chrome, but when I turn comment the
> mention configuration line, Firefox et al works, and Mozilla observer
> is not happy.
> 
> I need to get this solved like yesterday!

This is unrelated to PHP, this is about crossdomain javascript.
Nowadays you should tell which domains are ok to include 3rd party 
javascript, the more specific you can be the better.

You should avoid of including 3rd party scripts, have a local copy which 
you have verified with checksums that it's thew correct script and serve 
it from your domain. Don't forget to keep it updated so you won't have a 
bad vulnerability that someone can take advantage of.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#38989

On Sunday, October 18, 2020 at 7:37:13 AM UTC-5, The Doctor wrote:
> In article <2924c70d-67bd-468a...@googlegroups.com>,
> Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
> >On Saturday, October 17, 2020 at 5:27:21 PM UTC-5, The Doctor wrote: 
> > 
> >> Some good hints but no dice on the page yet. 
> > 
> >What does that mean? Are you getting a warning?
> According to one programmer they are getting error 500. 
> 
> I am using nginx 
> 
> here are to lines in the configuration 
> 
> #add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'"; 
> ##add_header Referrer-Policy "strict-origin-when-cross-origin"; 
> 
> These are commented out for a reason. 
> 
> Here is the page in question 

> [... ]

> All right in Chrone, Edge and AVG SEcure browser this fails to work. 
> 
> In Firefox, Waterfox, SeaMonkey, Opera and other similar browsers 
> 
> if the nginx.conf lines I comment above are turn off, the page 
> fails like it does in Chrome, but when I turn comment the 
> mention configuration line, Firefox et al works, and Mozilla observer 
> is not happy. 
> 
> I need to get this solved like yesterday!

I found the url of the page in question and am not seeing an error currently (besides a 404 error on a stylesheet).

<https://www.nk.ca/pdsolutions/indexnongst.html>

I see in your commented content security policy the following:

```
script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net;
```
In your original post you referenced the following script:

```
<script
src="https://code.jquery.com/jquery-3.3.1.js"
integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60="
crossorigin="anonymous"></script>
<script>
```

Notice you're missing <https://code.jquery.com> in your Content Security Policy

<https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src>

By including that domain you should be able to load the expected script.

[toc] | [prev] | [next] | [standalone]

#38992

In article <a902d526-d770-4555-860b-fc8634326e25n@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Sunday, October 18, 2020 at 7:37:13 AM UTC-5, The Doctor wrote:
>> In article <2924c70d-67bd-468a...@googlegroups.com>,
>> Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
>> >On Saturday, October 17, 2020 at 5:27:21 PM UTC-5, The Doctor wrote: 
>> > 
>> >> Some good hints but no dice on the page yet. 
>> > 
>> >What does that mean? Are you getting a warning?
>> According to one programmer they are getting error 500. 
>> 
>> I am using nginx 
>> 
>> here are to lines in the configuration 
>> 
>> #add_header Content-Security-Policy "default-src 'self'; script-src
>'self' https://ssl.google-analytics.com https://assets.zendesk.com
>https://connect.facebook.net; img-src 'self'
>https://ssl.google-analytics.com https://s-static.ak.facebook.com
>https://assets.zendesk.com; style-src 'self'
>https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self'
>https://themes.googleusercontent.com; frame-src
>https://assets.zendesk.com https://www.facebook.com
>https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src
>'none'"; 
>> ##add_header Referrer-Policy "strict-origin-when-cross-origin"; 
>> 
>> These are commented out for a reason. 
>> 
>> Here is the page in question 
>
>> [... ]
>
>> All right in Chrone, Edge and AVG SEcure browser this fails to work. 
>> 
>> In Firefox, Waterfox, SeaMonkey, Opera and other similar browsers 
>> 
>> if the nginx.conf lines I comment above are turn off, the page 
>> fails like it does in Chrome, but when I turn comment the 
>> mention configuration line, Firefox et al works, and Mozilla observer 
>> is not happy. 
>> 
>> I need to get this solved like yesterday!
>
>I found the url of the page in question and am not seeing an error
>currently (besides a 404 error on a stylesheet).
>
><https://www.nk.ca/pdsolutions/indexnongst.html>
>
>I see in your commented content security policy the following:
>
>```
>script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net;
>```
>In your original post you referenced the following script:
>
>```
><script
>src="https://code.jquery.com/jquery-3.3.1.js"
>integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60="
>crossorigin="anonymous"></script>
><script>
>```
>
>Notice you're missing <https://code.jquery.com> in your Content Security Policy
>
><https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src>
>
>By including that domain you should be able to load the expected script.

Tried that no dice!  
IS the referrer-policy interfering?

-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#38993

On Sunday, October 18, 2020 at 5:15:18 PM UTC-5, The Doctor wrote:

> Tried that no dice! 

> IS the referrer-policy interfering?

What does "no dice" mean? Did you get a warning/error in your console?

[toc] | [prev] | [next] | [standalone]

#38994

In article <b3fa70f0-34f1-40d5-879c-ef3f060e7885n@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Sunday, October 18, 2020 at 5:15:18 PM UTC-5, The Doctor wrote:
>
>> Tried that no dice! 
>
>> IS the referrer-policy interfering?
>
>What does "no dice" mean? Did you get a warning/error in your console?

No a thing and the referrer-policy is not the issue, the CSP 
seems to be the very culprit.

IF the CSP is turned on then the onbaord embedded javascript 
will not turn on!
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#38995

On Sunday, October 18, 2020 at 7:54:48 PM UTC-5, The Doctor wrote:
> In article <b3fa70f0-34f1-40d5...@googlegroups.com>,
> Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
> >On Sunday, October 18, 2020 at 5:15:18 PM UTC-5, The Doctor wrote: 
> > 
> >> Tried that no dice! 
> > 
> >> IS the referrer-policy interfering? 
> > 
> >What does "no dice" mean? Did you get a warning/error in your console?
> No a thing and the referrer-policy is not the issue, the CSP 
> seems to be the very culprit. 
> 
> IF the CSP is turned on then the onbaord embedded javascript 
> will not turn on!

Yes, as I mentioned earlier. I made a vanilla HTML page in IIS with your current security policy and got the mentioned error in the browser console:

```xml
<!-- web.config -->
<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>
```

```html
<!DOCTYPE html>
<html lang="en-US" dir="ltr">
    <head>
        <meta charset="utf-8">
        <title></title>
    </head>
    <body>
        <script src="https://code.jquery.com/jquery-3.3.1.js"
            integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" crossorigin="anonymous"></script>
    </body>
</html>
```

The browser console then reads:

```text
Refused to load the script 'https://code.jquery.com/jquery-3.3.1.js' because it violates the following Content Security Policy directive: "script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
```

By following my earlier suggestion of adding <https://code.jquery.com> to the script-src makes the error go away

```
script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net https://code.jquery.com;
```

[toc] | [prev] | [next] | [standalone]

#38996

In article <90f1d3fd-9971-4273-8463-92ec3b34d18cn@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Sunday, October 18, 2020 at 7:54:48 PM UTC-5, The Doctor wrote:
>> In article <b3fa70f0-34f1-40d5...@googlegroups.com>,
>> Michael Haufe (TNO) <t...@thenewobjective.com> wrote:
>> >On Sunday, October 18, 2020 at 5:15:18 PM UTC-5, The Doctor wrote: 
>> > 
>> >> Tried that no dice! 
>> > 
>> >> IS the referrer-policy interfering? 
>> > 
>> >What does "no dice" mean? Did you get a warning/error in your console?
>> No a thing and the referrer-policy is not the issue, the CSP 
>> seems to be the very culprit. 
>> 
>> IF the CSP is turned on then the onbaord embedded javascript 
>> will not turn on!
>
>Yes, as I mentioned earlier. I made a vanilla HTML page in IIS with your
>current security policy and got the mentioned error in the browser
>console:
>
>```xml
><!-- web.config -->
><?xml version="1.0" encoding="utf-8"?>
><configuration>
>    <system.webServer>
>        <httpProtocol>
>            <customHeaders>
>                <add name="Content-Security-Policy" value="default-src
>'self'; script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net; img-src 'self'
>https://ssl.google-analytics.com https://s-static.ak.facebook.com
>https://assets.zendesk.com; style-src 'self'
>https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self'
>https://themes.googleusercontent.com; frame-src
>https://assets.zendesk.com https://www.facebook.com
>https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src
>'none'" />
>            </customHeaders>
>        </httpProtocol>
>    </system.webServer>
></configuration>
>```
>
>```html
><!DOCTYPE html>
><html lang="en-US" dir="ltr">
>    <head>
>        <meta charset="utf-8">
>        <title></title>
>    </head>
>    <body>
>        <script src="https://code.jquery.com/jquery-3.3.1.js"
>           
>integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60="
>crossorigin="anonymous"></script>
>    </body>
></html>
>```
>
>The browser console then reads:
>
>```text
>Refused to load the script 'https://code.jquery.com/jquery-3.3.1.js'
>because it violates the following Content Security Policy directive:
>"script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net". Note that
>'script-src-elem' was not explicitly set, so 'script-src' is used as a
>fallback.
>```
>
>By following my earlier suggestion of adding <https://code.jquery.com>
>to the script-src makes the error go away
>
>```
>script-src 'self' https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net
>https://code.jquery.com;
>```

So what would

add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.nk.ca https://secure.nl2k.ab.ca https://code.jquery.com https://ajax.googleapis.com https://cdnjs.cloudflare.com/ https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net https://www3.moneris.com/ ; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' https://cdnjs.cloudflare.com/ https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";


-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#38997

On Sunday, October 18, 2020 at 9:43:49 PM UTC-5, The Doctor wrote:

> So what would 
> 
> add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.nk.ca https://secure.nl2k.ab.ca https://code.jquery.com https://ajax.googleapis.com https://cdnjs.cloudflare.com/ https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net https://www3.moneris.com/ ; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' https://cdnjs.cloudflare.com/ https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

Yes, that should do it. If not, then you should at least get a different error in your browser console. I'm assuming the integrity code is correct on your script.

[toc] | [prev] | [next] | [standalone]

#39008

In article <4724a06a-4c4f-4a06-85dd-e3bd4c65d387n@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Sunday, October 18, 2020 at 9:43:49 PM UTC-5, The Doctor wrote:
>
>> So what would 
>> 
>> add_header Content-Security-Policy "default-src 'self'; script-src
>'self' https://www.nk.ca https://secure.nl2k.ab.ca
>https://code.jquery.com https://ajax.googleapis.com
>https://cdnjs.cloudflare.com/ https://ssl.google-analytics.com
>https://assets.zendesk.com https://connect.facebook.net
>https://www3.moneris.com/ ; img-src 'self'
>https://ssl.google-analytics.com https://s-static.ak.facebook.com
>https://assets.zendesk.com; style-src 'self'
>https://cdnjs.cloudflare.com/ https://fonts.googleapis.com
>https://assets.zendesk.com; font-src 'self'
>https://themes.googleusercontent.com; frame-src
>https://assets.zendesk.com https://www.facebook.com
>https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src
>'none'";
>
>Yes, that should do it. If not, then you should at least get a different
>error in your browser console. I'm assuming the integrity code is
>correct on your script.

Referrer-Policy is working but the Content-Security-Policy shut down the
calculator and the CAPTCHA codes, both are based on javascript.

-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#39010

On Monday, October 19, 2020 at 4:58:51 PM UTC-5, The Doctor wrote:

> Referrer-Policy is working but the Content-Security-Policy shut down the 
> calculator and the CAPTCHA codes, both are based on javascript.

Which means you're missing entries in your domain list. Just look at the error console and it will tell you which ones are missing.

[toc] | [prev] | [next] | [standalone]

#39011

In article <4a9258de-1151-49c0-ba72-e816ef50849bn@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Monday, October 19, 2020 at 4:58:51 PM UTC-5, The Doctor wrote:
>
>> Referrer-Policy is working but the Content-Security-Policy shut down the 
>> calculator and the CAPTCHA codes, both are based on javascript.
>
>Which means you're missing entries in your domain list. Just look at the
>error console and it will tell you which ones are missing.

USing chrome I take it.
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#39012

In article <rmlr5o$t8o$55@gallifrey.nk.ca>,
The Doctor <doctor@doctor.nl2k.ab.ca> wrote:
>In article <4a9258de-1151-49c0-ba72-e816ef50849bn@googlegroups.com>,
>Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>>On Monday, October 19, 2020 at 4:58:51 PM UTC-5, The Doctor wrote:
>>
>>> Referrer-Policy is working but the Content-Security-Policy shut down the 
>>> calculator and the CAPTCHA codes, both are based on javascript.
>>
>>Which means you're missing entries in your domain list. Just look at the
>>error console and it will tell you which ones are missing.
>
>USing chrome I take it.

Just following up I found in 2 of the pages



Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute

How do Do that on a WEb PAge?
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

#39017

On Tuesday, October 20, 2020 at 8:14:35 AM UTC-5, The Doctor wrote:

> Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute 
> 
> How do Do that on a WEb PAge?

<https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite>

[toc] | [prev] | [next] | [standalone]

#39022

In article <457449fa-50ef-4d27-994c-14751ed6ebf9n@googlegroups.com>,
Michael Haufe (TNO) <tno@thenewobjective.com> wrote:
>On Tuesday, October 20, 2020 at 8:14:35 AM UTC-5, The Doctor wrote:
>
>> Indicate whether to send a cookie in a cross-site request by
>specifying its SameSite attribute 
>> 
>> How do Do that on a WEb PAge?
>
><https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite>
>

All right, trying to get this.
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b  
BC save the Province; on 24 October 2020, vote Liberal and not NDP!

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.javascript

csiph-web