26

My CSP report URI has received the following CSP violation:

{
  "csp-report":{
    "document-uri":"https://example.com/blog/somepage",
    "referrer":"",
    "violated-directive":"img-src 'self' data: p.typekit.net pbs.twimg.com platform.twitter.com q.stripe.com syndication.twitter.com",
    "effective-directive":"img-src",
    "original-policy": veryLongPolicyGoesHere,
    "blocked-uri":"about",
    "status-code":0
  }
}

Why would I get a CSP violation for the blocked-uri 'about'?

Is this the inbuilt about: URL from web browsers? I can't replicate the problem when I try.

3
  • I'm also seeing this from one particular user on a system with maybe 30-50 different users. I, too, can't fathom why the CSP violation is being triggered, but the particular user has a pretty old version of Chrome (38) on OS X 10.6, so that could be one reason; alternatively, it could be a browser extension, but we've yet to identify a particular one (they mentioned using Adblock and Disconnect, but they might have others). Feb 21, 2016 at 9:23
  • 1
    The question is from 2015, so just for info, there is a web platform test for that case since 2017, which should prevent that behaviour in modern browser: github.com/web-platform-tests/wpt/blob/master/…
    – RiZKiT
    Apr 11 at 11:56
  • 1
    @RiZKiT that's a useful comment but you might want to let people know what 'web platform' is. My own understanding is: "CSP violations for about:blank should no longer occur in current browsers that confirm to the web platform tests, which includes most major browsers" Apr 11 at 13:13

2 Answers 2

27

I worked with the user to discover it is indeed the Disconnect extension that is causing this. I contacted the people making the extension, and they confirmed they block URIs by replacing them with about:blank; this is what is causing the CSP violations.

Until Disconnect fixes their blocking scheme, I think the best approach is to simply ignore the CSP violation reports when blocked-uri is about.

5
  • 1
    Hello @mikemaccana. I've added script-src 'self' about but it doesn't work. Should I add about:blank? Please suggest Apr 17, 2018 at 17:39
  • about:blank is considered an invalid source. It seems like uBlock Origin does the same thing that Disconnect did: when it blocks something in a web page, it's replaced with about:blank. I have not found a workaround for this yet.
    – Tiffany
    Jul 9, 2018 at 15:38
  • 4
    I think I may have found a temporary workaround (until whatever causes about:blank on the page is fixed): adding about: to the directives that are violated. I tried adding it to the default-src, but I still received a violation report. I added it to img-src and script-src, and the violations did not show up. This may resolve your issue, @RomanMarusyk
    – Tiffany
    Jul 9, 2018 at 15:53
  • @Tiffany You should turn your comment into an answer, I believe it would be a better answer than the explanation given in the answer above. I would probably award it the bounty (but hurry, the bounty expires in 3 hours!)
    – Clément
    Dec 14, 2018 at 0:11
  • @Clément my apologies, just noticed your comment now. I will add it as an answer.
    – Tiffany
    Dec 14, 2018 at 16:32
5

I think I may have found a temporary workaround (until whatever causes about:blankon the page is fixed): adding about: to the directives that are violated. I tried adding it to the default-src, but I still received a violation report. I added it to img-src and script-src, and the violations did not show up.

3
  • That's useful, but it also sounds like a browser bug. Worth reporting it as an issue in the browser! Dec 17, 2018 at 11:27
  • Your specific situation, yes, it sounds like a browser bug. But there may be other reasons an about: violation comes up, which is what I was experiencing when I was researching this.
    – Tiffany
    Dec 17, 2018 at 12:18
  • 1
    No I mean your specific situation: adding to default.src not affecting the individual sources. Dec 17, 2018 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.