16

I have a Cordova app and after upgrading (5.0.0) it I'm unable to call any resource at all. I've added the whitelist plugin and added the following tag to index.html

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com">

I got the following errors:

Refused to load the script 'http://ajax.aspnetcdn.com/ajax/mobileservices/MobileServices.Web-1.2.5.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com".

Refused to load the script 'http://localhost:1337/vorlon.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com".

I've tried with the default policy that should allow everything, but still no luck.

I've also added the following to my config.xml file

<access origin="*" />
<allow-navigation href="*" />

and using the following plugins:

C:\Projects\TavlaApp>cordova plugin
com.microsoft.azure-mobile-services 1.2.7 "Windows Azure Mobile Services"
cordova-plugin-whitelist 1.0.1-dev "Whitelist"
nl.x-services.plugins.calendar 4.3.4 "Calendar"
nl.x-services.plugins.insomnia 4.0.1 "Insomnia (prevent screen sleep)"
org.apache.cordova.inappbrowser 0.6.0 "InAppBrowser"

Any idea's what to try?

Jonathan Hall
  • 75,165
  • 16
  • 143
  • 189
Larsi
  • 4,654
  • 7
  • 46
  • 75

3 Answers3

30

Wildcards are accepted, but only as a scheme, a port, or in the leftmost position of the hostname: 

*://*.example.com:*

...this would match all subdomains of example.com (but not example.com itself), using any scheme, on any port.

The key here, for you, might be the part in bold above.

You're specifying:

localhost:1337

*.ajax.aspnetcdn.com

But yet calling 

http://ajax.aspnetcdn.com

http://localhost:1337

Maybe change to 

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net http://localhost:1337 http://ajax.aspnetcdn.com">

I'm specifying port, but you could replace "http" with *

Hopefully this helps, or leads you in right direction.

Steve Kennedy
  • 5,312
  • 3
  • 26
  • 41
  • Hi! Thanks for looking into this. Your answer did not fix the issue, but I got it resolved removing and adding the plugins. – Larsi May 12 '15 at 18:47
  • Looked at so many examples this is the only one that worked.. cheers ! – K-G Dec 17 '15 at 19:24
  • Thanks, It works in my cordova project. I replaced the meta in my html file with this – Emmy Jan 18 '16 at 04:59
  • Excellent, when I put the url(host+port+context) in the tag meta its works for me too!!! – linhadiretalipe Feb 02 '16 at 22:59
  • I got an "invalid source" error in Chrome debugger when trying a wildcard as the scheme, i.e., `*://192.168.2.2` – JoshuaDavid Feb 04 '16 at 17:03
  • I confirmed my error - you cannot use a wildcard in the scheme. [See the spec here](https://www.w3.org/TR/CSP/#source-list-syntax) – JoshuaDavid Feb 04 '16 at 17:07
7

It seems like there was something wrong with my plugin/platform.

I did a remove of all plugins

   cordova platform rm android
   cordova platform add android

Then readded the plugins, and everything works.

Larsi
  • 4,654
  • 7
  • 46
  • 75
  • Cordova 5.0 seems to have changed a lot. Particularly for Android, where they've switched fully to gradle based builds, instead of ANT. I've encountered a few 3rd party plugins that no longer compile, referencing non-existent function calls. – mix3d May 21 '15 at 18:47
-4

I got this issue while trying to install cordova-plugins-whitelist for Cordova 5. Here is the install log:

Installing "cordova-plugin-whitelist" for android

This plugin is only applicable for versions of cordova-android greater than 4.0. If you have a previous platform version, you do *not* need this plugin since the whitelist will be built in.

As we can see, this plugin is no longer necessary in Cordova v5!!

JLavoie
  • 16,678
  • 8
  • 33
  • 39