Content Security Policy blocking script

💻 Development
1

I’m trying to integrate the Stripe API into my nextcloud custom app. But the content security policy is blocking the script.

There are errors in the console:

image
image1486×151 20.5 KB

Within my nextcloud files I found a file for configuring the CSP but haven’t figured out what values in there I need to change to resolve the errors.

/lib/public/AppFramework/Http/ContentSecurityPolicy.php

Any help here would be much appreciated! I’m new to nextcloud and still learning how to develop apps. Thank you!

2

Hello @socialistpizza, welcome to the Nextcloud community! :handshake:
please use search many topics where discussed already e.g. CSP "Content Security Policy" missing in Nextcloud manual

3

I have used the search and haven’t been able to find a solution to my issue.

4

Hello.

The mentioned files must not be altered. They are part of the server core and are fine as they are.

You are writing an app that needs a looser csp setting than normal (pure NC) apps need. So, read the documentation. There is an example on allowing all domains. I would highly suggest to whitelist individual domains to minimize the security impact.

Chris

1 Like
5

Hi,

Did you check your web server doesn’t have CSP policies itself (.htaccess, .conf…). You can check by accessing through a page that isn’t generated by Nextcloud (eg test.php).

I’ve fixed a CSP policy recently : see [Bug]: Content Security Policy (CSP) Error for preview-service-worker.js · Issue #39849 · nextcloud/server · GitHub

You can watch the fix from this PR: fix: #138 Missing worker policy when launching assistant by smarinier · Pull Request #139 · nextcloud/assistant · GitHub

Yours,