10 replies

Content security policy and default-src

Hello, I'm currently using

express

express

to serve my html files from a static directory but it seem my

index.html

index.html

web page isn't being served; I have the error

cannot get \

cannot get \

and in the console, this error:

Refused to connect to http://localhost:8080/ because it violates the following Content Security Policy directive (connect-src)

Refused to connect to http://localhost:8080/ because it violates the following Content Security Policy directive (connect-src)

here is my code:

import express from "express";
import { readFileSync } from "fs";
import { getProperties } from "properties-file";
import path from "path";
import { cwd } from "process";
import cors from "cors";

const allowedOrigins = ["http://localhost:8080"];
const corsOptions = { origin: allowedOrigins };

const configurationPath = path.join(
  `${cwd()}`,
  "Lesson-Product-Page-Back-end",
  "configurations",
  "configurations.properties"
);

const app = express();
const port = getProperties(readFileSync(configurationPath)).port;

app.use(cors(corsOptions));

// Serve static files
app.use(express.static(../Lesson-Product-Page"));

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`);
});

import express from "express";
import { readFileSync } from "fs";
import { getProperties } from "properties-file";
import path from "path";
import { cwd } from "process";
import cors from "cors";

const allowedOrigins = ["http://localhost:8080"];
const corsOptions = { origin: allowedOrigins };

const configurationPath = path.join(
  `${cwd()}`,
  "Lesson-Product-Page-Back-end",
  "configurations",
  "configurations.properties"
);

const app = express();
const port = getProperties(readFileSync(configurationPath)).port;

app.use(cors(corsOptions));

// Serve static files
app.use(express.static(../Lesson-Product-Page"));

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`);
});

I did google about what CSP is, from what I've understood it's a response header that is include for security purpose like preventing XSS attacks by preventing malicious scripts from being loaded in our websites from external resrouce (please feel free to add anything if I'm missing important points).

Now from what I've seen on google, they were suggesting to modify

helmet

helmet

configuration settings, from what I've read

helmet

helmet

is just some configurations that adhere to the web security standards.

So was wondering how should I proceed to overcome this error pls, I don't really understand why I'm getting this in the first place because everything is still local on my machine .

KP-C

Kevin Powell - Community•4mo ago•

10 replies

Faker

Content security policy and default-src

Hello, I'm currently using

express

express

to serve my html files from a static directory but it seem my

index.html

index.html

web page isn't being served; I have the error

cannot get \

cannot get \

and in the console, this error:

Refused to connect to http://localhost:8080/ because it violates the following Content Security Policy directive (connect-src)

Refused to connect to http://localhost:8080/ because it violates the following Content Security Policy directive (connect-src)

here is my code:

import express from "express";
import { readFileSync } from "fs";
import { getProperties } from "properties-file";
import path from "path";
import { cwd } from "process";
import cors from "cors";

const allowedOrigins = ["http://localhost:8080"];
const corsOptions = { origin: allowedOrigins };

const configurationPath = path.join(
  `${cwd()}`,
  "Lesson-Product-Page-Back-end",
  "configurations",
  "configurations.properties"
);

const app = express();
const port = getProperties(readFileSync(configurationPath)).port;

app.use(cors(corsOptions));

// Serve static files
app.use(express.static(../Lesson-Product-Page"));

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`);
});

import express from "express";
import { readFileSync } from "fs";
import { getProperties } from "properties-file";
import path from "path";
import { cwd } from "process";
import cors from "cors";

const allowedOrigins = ["http://localhost:8080"];
const corsOptions = { origin: allowedOrigins };

const configurationPath = path.join(
  `${cwd()}`,
  "Lesson-Product-Page-Back-end",
  "configurations",
  "configurations.properties"
);

const app = express();
const port = getProperties(readFileSync(configurationPath)).port;

app.use(cors(corsOptions));

// Serve static files
app.use(express.static(../Lesson-Product-Page"));

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`);
});

helmet

helmet

configuration settings, from what I've read

helmet

helmet

Content security policy and default-src

Similar Threads

Content security policy and default-src

Similar Threads

Similar Threads

Similar Threads