Skip to content

Content Security Policy blocks loading external resources #6

Description

@KiwiFlavoredApollo

Hi, images and video thumbnails were not displaying correctly and figured out it was due to container's internal web server (Nginx) blocking external resources. I have reported the issue on phpBB.com

Opened web browser's dev tool and got following error message:

Content-Security-Policy: The page settings blocked loading a resource (img-src) from https://i.ytimg.com/vi/EpMLAQbSYAw/hqdefault.jpg because it violated the following directive: "img-src 'self' data:"

/etc/nginx/http.d/default.conf had the following directive:

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; form-action 'self'" always;

After adding https: after img-src 'self' data:, the images displays without issues.

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'self'; form-action 'self'" always;

However, editing the file within the container is only a temporary solution.

Is it intentional that the container's Nginx have such configuration?
Following is my docker-compose.yml https://pastebin.com/55G8uxAe

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions