CSP - am I doing it wrong?
Description
CSP rules not properly parsed / computed
Steps to Reproduce
- Using enforced csp rules from configuration (
prod.secret.esx
in my case) - Implement more than one rule in the array
Example:
config :mobilizon, :http_security,
enabled: true,
sts: false,
sts_max_age: 31_536_000,
csp_policy: [
script_src: ["example.com", "matomo.example.com"],
[..]
Expected behaviour:
Both domains should be part of said CSP rule for the category.
Actual behaviour:
I get a merged rule which results in CSP block since it doesn't match anything functional.
In Chrome console I see:
Refused to load the script 'https://example.com/extra.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'sha256-XXXXXXXXXXXXXXXXXXXXXXXX=' example.commatomo.example.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
→ example.commatomo.example.com
Reproduces how often:
100%
Versions
Mobilizon 1.1.0
Additional Information
Current workaround is to add a space in front of any further element:
csp_policy: [
script_src: ["example.com", " matomo.example.com"],
[..]
Edited by Popi