0

I have 2 JHipster Spring Boot Apps. In dev A runs on localhost:8083 and B on localhost:8080.

In app A I have added an API Controller, which works fine when triggered from Postman.

From app B, when an Angular form calls the endpoint, I am seeing:

polyfills.1266a5de5d4c3910.js:1 Refused to connect to 'http://www.localhost:8083/MYURL' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

In SecurityConfiguration.java there is:

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

where I replaced:

   http
      .and()
          .headers() 
         .contentSecurityPolicy(jHipsterProperties.getSecurity().getContentSecurityPolicy())

with

    http
      .and()
          .headers() 
          .contentSecurityPolicy("default-src *; connect-src *")

but it gives the same error.

I am thinking my code is explicitly setting both 'connect-src' and 'default-src' to accept anything - but no. Is this the right strategy? What am I missing?

Meta data:

  • JHipster: v7.9.3
  • Chrome cache cleared
  • Java 11
  • Windows 11
6
  • 1
    Why would an API call require a javascript resource? Your angular form in app A should request only JSON from app B where content-src is not applied like in Postman. So, I guess something is wrong in your form and should be fixed before thinking about CSP. Did you check that request content type is JSON? Jun 29 at 10:06
  • 1
    Brilliant, thanks Gael - it would never have occurred that not setting content type to JSON would throw "violates the following Content Security Policy directive: "default-src 'self'". But now I believe I am seeing github.com/jhipster/generator-jhipster/issues/20987 as the error is now " blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status."
    – Harper2021
    Jun 29 at 14:59
  • Great. Once you get a fix, you should write an answer here to help others. Jun 29 at 20:33
  • Your very thoughtful Gael, thanks. I got "Response to preflight request doesnt pass access control check" error because in application.yml I uncommented the cors lines to allow cross origin. Not wanting to limit the origins I put "*" in allowed-origines rather than "http......". * is not allowed by Spring Boot, but it did not complain and somehow thats the error I saw.
    – Harper2021
    Jun 30 at 9:09
  • Another issue I did not know I did not know - if the 2 apps are in Docker containers in the same network then I am thinking they communicate through the Docker network, not the client localhost. So the connect-src cant be localhost but something about the Docker network source. Am looking to push these issues into a Nginx container.
    – Harper2021
    Jul 1 at 10:56

1 Answer 1

0

Most likely you have multiple Content Security Policies defined. Check your response headers and meta tags. You likely have a default policy "default-src 'self'" set by a framework or webserver that you need to disable or modify. Adding another policy can only make it stricter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.