Unable to open /explorer because of Content Security Policy violation. #8592

maninder-pal-singh · 2022-05-11T09:22:02Z

maninder-pal-singh
May 11, 2022

I am setting CSP using helmet

Following is the loopback version and the versions of its dependencies

@loopback/cli version: 4.0.0

@loopback/* dependencies:

@loopback/authentication: ^9.0.0
@loopback/boot: ^5.0.0
@loopback/build: ^9.0.0
@loopback/context: ^5.0.0
@loopback/core: ^4.0.0
@loopback/metadata: ^5.0.0
@loopback/openapi-spec-builder: ^5.0.0
@loopback/openapi-v3: ^8.0.0
@loopback/repository-json-schema: ^6.0.0
@loopback/repository: ^5.0.0
@loopback/rest: ^12.0.0
@loopback/testlab: ^5.0.0
@loopback/docs: ^5.0.0
@loopback/example-hello-world: ^5.0.0
@loopback/example-log-extension: ^5.0.0
@loopback/example-rpc-server: ^5.0.0
@loopback/example-todo: ^6.0.0
@loopback/example-soap-calculator: ^5.0.0
@loopback/service-proxy: ^5.0.0
@loopback/http-caching-proxy: ^4.0.0
@loopback/http-server: ^4.0.0
@loopback/example-todo-list: ^6.0.0
@loopback/dist-util: ^0.4.0
@loopback/rest-explorer: ^5.0.0
@loopback/eslint-config: ^13.0.0
@loopback/example-express-composition: ^5.0.0
@loopback/example-greeter-extension: ^5.0.0
@loopback/booter-lb3app: ^4.0.0
@loopback/example-lb3-application: ^5.0.0
@loopback/example-greeting-app: ^5.0.0
@loopback/example-context: ^5.0.0
@loopback/repository-tests: ^0.21.0
@loopback/health: ^0.11.0
@loopback/authorization: ^0.12.0
@loopback/rest-crud: ^0.14.0
@loopback/security: ^0.8.0
@loopback/authentication-passport: ^5.0.0
@loopback/example-metrics-prometheus: ^0.10.0
@loopback/metrics: ^0.11.0
@loopback/model-api-builder: ^4.0.0
@loopback/logging: ^0.9.0
@loopback/example-access-control-migration: ^5.0.0
@loopback/example-file-transfer: ^4.0.0
@loopback/example-rest-crud: ^4.0.0
@loopback/apiconnect: ^0.10.0
@loopback/example-validation-app: ^4.0.0
@loopback/cron: ^0.9.0
@loopback/example-multi-tenancy: ^0.13.0
@loopback/example-passport-login: ^4.0.0
@loopback/authentication-jwt: ^0.12.0
@loopback/context-explorer: ^0.8.0
@loopback/express: ^5.0.0
@loopback/example-todo-jwt: ^4.0.0
@loopback/mock-oauth2-provider: ^0.6.0
@loopback/pooling: ^0.8.0
@loopback/typeorm: ^0.7.0
@loopback/example-graphql: ^0.7.0
@loopback/graphql: ^0.8.0
@loopback/filter: ^3.0.0
@loopback/rest-msgpack: ^0.8.0
@loopback/example-binding-resolution: ^0.7.0
@loopback/example-webpack: ^0.8.0
@loopback/example-socketio: ^0.6.0
@loopback/socketio: ^0.6.0
@loopback/monorepo: ^0.5.0
@loopback/tsdocs: ^4.0.0
@loopback/example-references-many: ^6.0.0

frbuceta · 2022-05-11T10:10:46Z

frbuceta
May 11, 2022
Maintainer

I am setting CSP using helmet

Following is the loopback version and the versions of its dependencies

@loopback/cli version: 4.0.0

@loopback/* dependencies:

@loopback/authentication: ^9.0.0

@loopback/boot: ^5.0.0

@loopback/build: ^9.0.0

@loopback/context: ^5.0.0

@loopback/core: ^4.0.0

@loopback/metadata: ^5.0.0

@loopback/openapi-spec-builder: ^5.0.0

@loopback/openapi-v3: ^8.0.0

@loopback/repository-json-schema: ^6.0.0

@loopback/repository: ^5.0.0

@loopback/rest: ^12.0.0

@loopback/testlab: ^5.0.0

@loopback/docs: ^5.0.0

@loopback/example-hello-world: ^5.0.0

@loopback/example-log-extension: ^5.0.0

@loopback/example-rpc-server: ^5.0.0

@loopback/example-todo: ^6.0.0

@loopback/example-soap-calculator: ^5.0.0

@loopback/service-proxy: ^5.0.0

@loopback/http-caching-proxy: ^4.0.0

@loopback/http-server: ^4.0.0

@loopback/example-todo-list: ^6.0.0

@loopback/dist-util: ^0.4.0

@loopback/rest-explorer: ^5.0.0

@loopback/eslint-config: ^13.0.0

@loopback/example-express-composition: ^5.0.0

@loopback/example-greeter-extension: ^5.0.0

@loopback/booter-lb3app: ^4.0.0

@loopback/example-lb3-application: ^5.0.0

@loopback/example-greeting-app: ^5.0.0

@loopback/example-context: ^5.0.0

@loopback/repository-tests: ^0.21.0

@loopback/health: ^0.11.0

@loopback/authorization: ^0.12.0

@loopback/rest-crud: ^0.14.0

@loopback/security: ^0.8.0

@loopback/authentication-passport: ^5.0.0

@loopback/example-metrics-prometheus: ^0.10.0

@loopback/metrics: ^0.11.0

@loopback/model-api-builder: ^4.0.0

@loopback/logging: ^0.9.0

@loopback/example-access-control-migration: ^5.0.0

@loopback/example-file-transfer: ^4.0.0

@loopback/example-rest-crud: ^4.0.0

@loopback/apiconnect: ^0.10.0

@loopback/example-validation-app: ^4.0.0

@loopback/cron: ^0.9.0

@loopback/example-multi-tenancy: ^0.13.0

@loopback/example-passport-login: ^4.0.0

@loopback/authentication-jwt: ^0.12.0

@loopback/context-explorer: ^0.8.0

@loopback/express: ^5.0.0

@loopback/example-todo-jwt: ^4.0.0

@loopback/mock-oauth2-provider: ^0.6.0

@loopback/pooling: ^0.8.0

@loopback/typeorm: ^0.7.0

@loopback/example-graphql: ^0.7.0

@loopback/graphql: ^0.8.0

@loopback/filter: ^3.0.0

@loopback/rest-msgpack: ^0.8.0

@loopback/example-binding-resolution: ^0.7.0

@loopback/example-webpack: ^0.8.0

@loopback/example-socketio: ^0.6.0

@loopback/socketio: ^0.6.0

@loopback/monorepo: ^0.5.0

@loopback/tsdocs: ^4.0.0

@loopback/example-references-many: ^6.0.0

Please open an issue with reproduction

4 replies

achrinza May 11, 2022
Maintainer

I don't think this is a bug

frbuceta May 11, 2022
Maintainer

@achrinza But at least we need a reproduction to observe what is happening

achrinza May 11, 2022
Maintainer

Yes, it'll be great if a reproduction sandbox can be created in this GitHub Discussion (Though I think the steps are pretty clear as-is). But if there's no clear indication that it's a bug in LoopBack 4 itself, then I don't think we need to open a new issue.

maninder-pal-singh May 11, 2022
Author

Sure let me create a reproduction sandbox of the same, Thanks

raymondfeng · 2022-05-11T14:32:22Z

raymondfeng
May 11, 2022
Maintainer

It's the effect of contentSecurityPolicy settings. You'll need update such directives to allow loopback api explorer so that the UI can access resources from other domains. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#directives.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Unable to open /explorer because of Content Security Policy violation. #8592

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Unable to open /explorer because of Content Security Policy violation. #8592

Uh oh!

maninder-pal-singh May 11, 2022

Replies: 2 comments · 4 replies

Uh oh!

frbuceta May 11, 2022 Maintainer

Uh oh!

achrinza May 11, 2022 Maintainer

Uh oh!

frbuceta May 11, 2022 Maintainer

Uh oh!

achrinza May 11, 2022 Maintainer

Uh oh!

maninder-pal-singh May 11, 2022 Author

Uh oh!

raymondfeng May 11, 2022 Maintainer

maninder-pal-singh
May 11, 2022

Replies: 2 comments 4 replies

frbuceta
May 11, 2022
Maintainer

achrinza May 11, 2022
Maintainer

frbuceta May 11, 2022
Maintainer

achrinza May 11, 2022
Maintainer

maninder-pal-singh May 11, 2022
Author

raymondfeng
May 11, 2022
Maintainer