Content security policy

How To
1

I am running a simple expressjs app with crud functionality. When attempting to post an article I am getting an error related to csp Content Security Policy: The page’s settings blocked the loading of a resource at https://express-sqlite.fly.dev/ (“default-src”). I tried all sorts of seting up csp on my express server using helmetjs like so

app.use(
  helmet.contentSecurityPolicy({
    useDefaults: false,
    directives: {
      "default-src": [`"self"`, `https://express-sqlite.fly.dev/`],
    },
  })

but still my requests are being blocked. I was wondering if anyone has faced this issue and managed to resolve it?

2

Did you try only specifying "self"? based on these docs, it seems like just “self” should be required: CSP: default-src - HTTP | MDN

3

yes I did try self

4

I just noticed that this issue arises in firefox only. in chrome requests works just fine

1 Like