[
https://issues.apache.org/jira/browse/OPENMEETINGS-2247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17085385#comment-17085385
]
Maxim Solodovnik commented on OPENMEETINGS-2247:
------------------------------------------------
I currently have these rules in CSP heder of response:
{code}
Content-Security-Policy: default-src 'none'; script-src 'strict-dynamic'
'nonce-_IaPH1-NGi_oGdqkSF5E63iT' 'strict-dynamic'
https://www.google-analytics.com https://ssl.google-analytics.com; style-src
'nonce-_IaPH1-NGi_oGdqkSF5E63iT' https://fonts.googleapis.com/css; img-src
'self' data: https://www.google-analytics.com
https://yandex.st/morda-logo/i/favicon.ico
https://www.google.ru/images/google_favicon_128.png
https://www.facebook.com/images/fb_icon_325x325.png
https://vk.com/images/icons/pwa/apple/default.png; connect-src 'self'; font-src
'self' https://fonts.gstatic.com; manifest-src 'self'; media-src 'self';
child-src 'self'; frame-src 'self' 'self'
{code}
You can find {{connect-src 'self';}} so WS connection works for me on demo
Can it be some caching issue?
Can you `hard reload` and check the headers?
> CSP should be re-worked
> -----------------------
>
> Key: OPENMEETINGS-2247
> URL: https://issues.apache.org/jira/browse/OPENMEETINGS-2247
> Project: Openmeetings
> Issue Type: Task
> Components: Builds, UI
> Affects Versions: 5.0.0-M4
> Reporter: Maxim Solodovnik
> Assignee: Maxim Solodovnik
> Priority: Major
> Fix For: 5.0.0-M4
>
> Attachments: image-2020-04-17-14-37-11-501.png,
> image-2020-04-17-14-59-08-307.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Previously CSP was implemented via
> {{header.csp.frame.options}} and {{header.content.security.policy}}
> https://openmeetings.apache.org/GeneralConfiguration.html
> Above setting were applied here
> https://github.com/apache/openmeetings/blob/5.0.0-M3/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java#L244
> This should be re-worked
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
