[GitHub] blukis opened a new issue #560: Content-security-policy bug

[GitBox <gi...@apache.org>]

blukis opened a new issue #560: Content-security-policy bug
URL: https://github.com/apache/cordova-android/issues/560
 
 
   I believe I found an issue with content-security-policy in cordova environment...
   
   I have an app that includes this page in an iframe: "http://201x.plurib.us/test/2018/content-security-outer.html", which in turn includes this page in another iframe "http://201x.plurib.us/test/2018/content-security-inner.php".  (Note: these are very short pages created to debug this issue.  The original page causing the issue was a shopify checkout page, found in the comments of "...outer.html".)
   
   "...inner.php" includes this http header:
   `Content-Security-Policy: frame-ancestors *`
   
   "...outer.html" (and its inner iframe) loads OK in Chrome on Android, but when included the url in a cordova app, "...inner.php" iframe does not load.  (Note: app has "cordova-plugin-whitelist" plugin and `<access origin="*" />`).
   
   When I enable android debugging and check the remote device console in Chrome, I see this error in the Chrome console:
   
   > Refused to display 'http://201x.plurib.us/test/2018/content-security-inner.php' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors *".
   
   Maybe I'm missing something, but I'm not sure how anything could fail to pass "frame-ancestors *".  Is it a cordova issue?  Thanks!

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org