Content-Security-Policy

  • Resolved bulls_shark

    (@bulls_shark)


    6 years, 1 month ago

    Dear Support Team, I have your plugin running on more than 20 pages, it is simple and works. Now I have set the https header and if the content security policy is activated, the plugin no longer works.

    After entering the login data comes: 502 Bad Gateway

    The log file then says, 3618 # 0: * 149213 upstream sent too big header while reading response header from upstream

    Do you have a solution for me which I have to either enter etc.?

    thanks for the support

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author Kaspars

    (@kasparsd)

    6 years, 1 month ago

    Thanks for reporting the issue @bulls_shark!

    This appears to be something related to the server configuration since the 502 response is generated by the server. Could you please help us replicate the issue and understand which parts of the plugin are responsible for any of that?

    Thanks!

    p.s. I’m marking this as resolved since this sounds like an integration issue.

    Thread Starter bulls_shark

    (@bulls_shark)

    6 years, 1 month ago

    Hello, thanks for the support. Could it be that the contact to the Google server is blocked, which causes the error message?

    I believe that the script is shared with Google Auth. Can you please tell me what it’s called so I can test it?

    I am currently using the following settings.

    default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com/ https://www.gstatic.com/recaptcha/releases/JZfekeK8w6ZlhLfH_ZyseSLX/recaptcha__de_at.js https://www.gstatic.com/recaptcha/releases/mhgGrlTs_PbFQOW4ejlxlxZn/recaptcha__de_at.js https://www.gstatic.com/recaptcha/releases/mhgGrlTs_PbFQOW4ejlxlxZn/recaptcha__de.js https://s.ytimg.com/ https://use.fontawesome.com/ https://www.youtube.com/ https://www.youtube-nocookie.com https://*.googleapis.com *.google-analytics.com *.google.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com/ https://vimeo.com/ https://use.fontawesome.com https://player.vimeo.com/ https://fonts.googleapis.com/; img-src 'self' https://updates.themepunch-ext-a.tools/ https://woocommerce.com/ https://d3t0oesq8995hv.cloudfront.net/ https://chart.googleapis.com/ https://plugins.thimpress.com/ https://static.mailster.co/ https://www.dummyimage.com/ https://optimizingmatters.com/ https://thimpress.com/ https://vimeo.com/ https://preview.thimpress.com/ https://thim.staging.wpengine.com https://updates.themepunch-ext-b.tools https://s3.envato.com/ https://updates.thimpress.com/ https://img.youtube.com https://secure.gravatar.com https://s.w.org https://ww.wp.xz.cn https://ps.w.org data:; connect-src 'self'; font-src 'self' https://use.fontawesome.com/ https://fonts.gstatic.com data:; media-src 'self' https://vimeo.com/ https://thimpresswp.github.io/; child-src 'self'; form-action 'self' https://account.envato.com/ https://updates.thimpress.com/ https://api.envato.com/; frame-ancestors 'self'; object-src 'self'; frame-src 'self' https://vimeo.com/ https://player.vimeo.com/ https://www.youtube-nocookie.com/ https://*.youtube.com https://www.google.com https://staticxx.facebook.com https://w.soundcloud.com https://web.facebook.com/; base-uri 'none'

    Thanks for the support

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Content-Security-Policy’ is closed to new replies.