Ask questionsContent Security Policy seemingly absent from new instance


After changing the admin settings for content-src and script-src I am seeing CORS errors even after deleting an instance and creating a fresh new one. (Param store has been untouched by me)

Example error below:

Refused to prefetch content from '' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'prefetch-src' was not explicitly set, so 'default-src' is used as a fallback.

Also from the discussion, prior to a fresh instance, I was seeing

Content Security Policy: The page’s settings blocked the loading of a resource at https://bp-hubs-assets.<internaldomain>.com/...

You can see the error in Spoke or in a room at the following Hubs Cloud instance:

The above instance is currently in line with the hubs-cloud branch.


Answer questions antpb

oh, worth noting this is also happening on :O

edit: Had some time this evening to compare to my Hub Cloud instance. What stands out the most is the content security policy errors happening around google analytics. Seemingly every external source is throwing issue.

Here's a snippet of the google analytics error in the Mozilla Spoke instance:

Refused to connect to '' because it violates the following Content Security Policy directive: "connect-src wss:// wss:// https://hubs.local:3000 'self' wss:// wss:// wss://:443 https://:443 data: blob:".


Related questions

No questions were found.
Github User Rank List