My app is quite straight forward Jhispter (with Angular) application, that uses mapbox
and google fonts
as external libraries.
I simply deployed it to Elastic Beanstalk.
I googled and found some answers that I should only change the meta-data tag in my index.html
file to:
<meta http-equiv="Content-Security-Policy" content="default-src *;
img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *;
style-src 'self' 'unsafe-inline' *">
But it did not work.
I also enabled it in the properties file, but seems with no impcat.
cors:
allowed-origins: "*"
allowed-methods: "*"
allowed-headers: "*"
exposed-headers: "Link,X-Total-Count"
allow-credentials: true
max-age: 1800
SecurityConfiguration.java
file. Around Jhipster 5.0.x, the property CSP headers is added to security configuration. As you can see real locks is performed by not your CSP, hence somewhere is published another one. It should be smthng like.headers().contentSecurityPolicy("default-src 'self';")
there. – granty Dec 26 '20 at 8:41.contentSecurityPolicy("default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:")
should i remove it completeley to enable all CSP? – Houssem Badri Dec 26 '20 at 8:47SecurityConfiguration.java
file - CSP will be delivered with HTTP header (it's a preferred way). If you comment/remove CSP lines in above file, you'll able to publish CSP via meta tag. It's up to you. – granty Dec 26 '20 at 9:57