csp | CSP/Actor/Transducer Experiments | Reactive Programming library

So if anyone comes across this question for some reason, I figured it out. As it turns out, the cross-origin-embedder-policy header was giving me troubles. This had to be disabled. Helmet has a built in option to do so crossOriginEmbedderPolicy: false,. More info here.

For most people I guess that'll work. However it did not work for me. The header was still being set. Disabling it with express also did not work (app.disable('cross-origin-embedder-policy');).

I have no idea why the header was still being set, but I had to disable it manually in my nginx configuration: proxy_hide_header cross-origin-embedder-policy;

My config:

If you have not yet run a git gc the branch maybe already inside your reflog, so you have to run git reflog and write down the commit hash related to the deleted branch, then issue git branch to recover the deleted branch.

Please tell me if it solved your issue.

Regards.

You need to draw the plot without axes and specify where you want the breaks and what you want their labels to be:

I have not tried to reproduce, but from reading this it would make sense for Firefox to start blocking as you sandboxed the document, meaning it has an opaque origin and therefore the image will appear cross-origin.

As for Chrome, could sandboxing have been in effect there too somehow?

Delivering CSP via HTTP header is a preferred way.

Meta tag has the same functionality but for technical reasons it does not support some directives: frame-ancestors, report-uri, report-to and sandbox. Also the Content-Security-Policy-Report-Only is not supported in meta tag.

In SPA (Single Page Application), a meta tag is traditionally used for CSP delivery, because a lot of hostings do now allow to manage of HTTP header.

When SSR (Server Side Rendering), an HTTP header is used more often.

You can use any technically convenient CSP delivery method (keeping in mind the limitations of the meta tag), but do not use both at the same time. Both policies will be executed one after the other, so in case of differences, a stricter one will apply actually.

Note that:

• CSP meta tag should be placed in , otherwise it will not work.
• Changing the meta tag by javascript will result in both the old and the new policies being in effect.
• in cases of CSP for non-HTML files, the meta tag can not be used technically

With some help from Michael Koper, we were able to sort this out. The controller methods were missing status: :unprocessable_entity on the format.html statements. So changing:

format.html { render action: "new"}

to

format.html { render action: "new", status: :unprocessable_entity }

Solved this issue.

You might have to change your JavaScript code to have a full path to the HTML file.

Try with the code below, it will configure Electron. In the event listening, it is creating a new BrowserWindow with no configuration (although you can add it if you like). Then, it is loading the full path to the HTML file.

CSP reporting API is not a subject of CORS, because no resources are loaded from the server. Browser just send a report and does not expect any headers/response from CSP reporting API. To show this you return the 204 No content header so that the browser does not expect a response.

Why do you think that you have a CORS issue? When you proxying site via Cloudflare.com, it injects into all pages a NEL/Report-to (the same as CSP/Report-to) headers with CF's own domain without any CORS issue: I had implemented a lot of endpoints for report-uri and never face any CORS issues.

Note that report-uri is obsolete in favour report-to directive, but browsers does not supports report-to except Chrome.

When you simulate sending a report for testing purposes, do not use an ordinary ajax POST request - it is subject to CORS.
To imitate sending real report, generate a page on third-party domain:

After some debugging, I found that the issue seems to be Firefox specific, and only for endpoints that return a JSON object.

For example, if I built an endpoint that just returned a String, Firefox would return the String and the icon would be in the tab on the top.