Cordova Content Security Policy

Question

I have a Cordova app and after upgrading (5.0.0) it I'm unable to call any resource at all. I've added the whitelist plugin and added the following tag to index.html

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com">

I got the following errors:

Refused to load the script 'http://ajax.aspnetcdn.com/ajax/mobileservices/MobileServices.Web-1.2.5.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com".

Refused to load the script 'http://localhost:1337/vorlon.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com".

I've tried with the default policy that should allow everything, but still no luck.

I've also added the following to my config.xml file

<access origin="*" />
<allow-navigation href="*" />

and using the following plugins:

C:\Projects\TavlaApp>cordova plugin
com.microsoft.azure-mobile-services 1.2.7 "Windows Azure Mobile Services"
cordova-plugin-whitelist 1.0.1-dev "Whitelist"
nl.x-services.plugins.calendar 4.3.4 "Calendar"
nl.x-services.plugins.insomnia 4.0.1 "Insomnia (prevent screen sleep)"
org.apache.cordova.inappbrowser 0.6.0 "InAppBrowser"

Any idea's what to try?

Beamer

Answer 1

It seems like there was something wrong with my plugin/platform.

I did a remove of all plugins

   cordova platform rm android
   cordova platform add android

Then readded the plugins, and everything works.

Beamer

Cordova 5.0 seems to have changed a lot. Particularly for Android, where they've switched fully to gradle based builds, instead of ANT. I've encountered a few 3rd party plugins that no longer compile, referencing non-existent function calls. – Schriever

Answer 2

Wildcards are accepted, but only as a scheme, a port, or in the leftmost position of the hostname:

*://*.example.com:* 

...this would match all subdomains of example.com (but not example.com itself), using any scheme, on any port.

The key here, for you, might be the part in bold above.

You're specifying:

localhost:1337

*.ajax.aspnetcdn.com

But yet calling

http://ajax.aspnetcdn.com

http://localhost:1337

Maybe change to

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net http://localhost:1337 http://ajax.aspnetcdn.com">

I'm specifying port, but you could replace "http" with *

Hopefully this helps, or leads you in right direction.

Digestant

Hi! Thanks for looking into this. Your answer did not fix the issue, but I got it resolved removing and adding the plugins. – Beamer

Looked at so many examples this is the only one that worked.. cheers ! – Helicopter

Thanks, It works in my cordova project. I replaced the meta in my html file with this <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 ajax.aspnetcdn.com"> – Aswarm

Excellent, when I put the url(host+port+context) in the tag meta its works for me too!!! – Virtuosity

I got an "invalid source" error in Chrome debugger when trying a wildcard as the scheme, i.e., *://192.168.2.2 – Ga

I confirmed my error - you cannot use a wildcard in the scheme. See the spec here – Ga

Answer 3

I got this issue while trying to install cordova-plugins-whitelist for Cordova 5. Here is the install log:

Installing "cordova-plugin-whitelist" for android

This plugin is only applicable for versions of cordova-android greater than 4.0. If you have a previous platform version, you do *not* need this plugin since the whitelist will be built in.

As we can see, this plugin is no longer necessary in Cordova v5!!

Horme

Isn't it the opposite? You do need it for >= v4? – Splanchnic