I have 2 JHipster Spring Boot Apps. In dev A runs on localhost:8083 and B on localhost:8080.
In app A I have added an API Controller, which works fine when triggered from Postman.
From app B, when an Angular form calls the endpoint, I am seeing:
polyfills.1266a5de5d4c3910.js:1 Refused to connect to 'http://www.localhost:8083/MYURL' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
In SecurityConfiguration.java there is:
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
where I replaced:
http
.and()
.headers()
.contentSecurityPolicy(jHipsterProperties.getSecurity().getContentSecurityPolicy())
with
http
.and()
.headers()
.contentSecurityPolicy("default-src *; connect-src *")
but it gives the same error.
I am thinking my code is explicitly setting both 'connect-src' and 'default-src' to accept anything - but no. Is this the right strategy? What am I missing?
Meta data:
- JHipster: v7.9.3
- Chrome cache cleared
- Java 11
- Windows 11