feature-policy | Middleware for setting the Feature-Policy HTTP response | HTTP library

This is happening because you are using a plain Socket with a hardcoded port 80. This means that, independently of using a http or https url in your input, you are requesting via the unsecure protocol http.

In this situation, the server is telling you, as Samuel L. Jackson would say "hey mf! you are trying to reach me through an f unsecure protocol, HTTP. Use a secure one mf, the f HTTPS.", and so, it responds with 301 (which just means "use this url, not the original one"), with the Location header pointing to the correct URL, the https one.

So apparently the 301 Location is the same URL, but it's not, because in your code you are hardcoding http, and the server response is redirecting to https.

To make your code work with https, instead of a plain Socket use this:

Some time ago Arefs announced rendering web pages and executing JavaScript for its Crawler and for Site Audit tool.

To do this, Ahrefs had to partially implement browser rendering. This was not a full-fledged browser implemented, but some part of its "ready to use" code was taken. This renderer, inherited partial support of HTTP headers, which was built into this "ready-to-use" code.
But the main task was to search for links inserted via javascript, and not full support for HTTP headers.

Therefore, the implementation used incorrectly executes some headers, which one it can only be found out by experimenting - disable them one by one and wait for the results.
But these are hardly headers Referrer-Policy, Feature-Policy and X-Frame-Options - they cannot result in a 404 Not Found error.

Most likely, these are just an Ahrefs renderer errors of loading external scripts, they are unlikely to have an impact on the analysis capabilities of Ahrefs or SE ranking.

Briefly: you have to add http://localhost:8080 to the default-src directive.

Tl; DR;: the 'self' token is insidious, because you intuitively endow him with powers that he fails to fulfill.

Browsers substisute the 'self' token with the "tuple origin" (scheme + host_name + port_number) of the page URL from the browser's address bar, and then they add some CSP-specific magic:

• allow ws: + host_name + ws_standard_port
• allow upgrade ws: to wss: and http: to https: in CSP3-browsers

So, what do we have:

1. Your app uses fetch to access Spring Boot REST API which should be covered by missing connect-src directive, therefore browser uses default-src as fallback.
2. Browser transform default-src 'self' to the default-src http://your_domain.com:80 or default-src https://your_domain.com:443 (depending on how you load the page).

As you can see both of these do not allow http://localhost:8080. Although actually localhost is an alias of the your_domain.com, but CSP does not know this, and just blocking because of mismatch host_name + port_number.

But if you will load app with the http://localhost:8080/your_app_path url, fetch to REST API will be allowed because covered by 'self'

So the issue seemed to be related to the Redirect directives. We removed them and added the following for 443:

This error should be debug log and safe to ignore:

Project update error: rpc error: code = DeadlineExceeded desc = context deadline exceeded [access_client]

(I created an internal ticket to hide this)

Error 12 usually means access server is down or at least not available to metadata. I was not able to reproduce the issue. You can check if access is available buy a simple curl command:

If you have not any issues with certificate maybe is just cache of your browser. Try clear data, or open in other device you should be done!

if you want redirect http connections to https add this following to .htaccess

@granty's advice together with this post https://help.nextcloud.com/t/header-modification-add-google-search-more-than-8-apps-smaller-text/94985/8 helped me solve the CSP problem. Basically I didnt need to add any CSP in my reverse proxy or any of the nginx servers. All I have to do is to edit the stock ContentSecurityPolicy.php and add the login.xxxx.com.au domain to permit it to submit form-action.

This is the code I had to update: File located at: /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php

Since no one could directly give me a help, i found by myself the answer that works like a charm.

What is the Permissions Policy header

The Permission Policy header is a security header that controls which browser features can be used. Besides implementing these rules for your own content it can also prevent external iframes from using these browser features, making it a powerful header to secure your site.

This allows you to have fine-grained control over which browser functions your site can use. There are a lot of directives that can be controlled with the Permission Policy header. For an extensive overview of all directives see New Permissions-Policy Directives and Features

And the code inside the .htaccess file is: