Roll20 uses cookies to improve your experience on our site. Cookies enable you to enjoy certain features, social sharing functionality, and tailor message and display ads to your interests on our site and others. They also help us understand how our site is being used. By continuing to use our site, you consent to our use of cookies. Update your cookie preferences .
×
Create a free account
This post has been closed. You can still view previous posts, but you can't post any new replies.

'Content Security Policy', help me troubleshoot?

1423920806
Gen Kitty
Forum Champion
So, my game is resuming tomorrow after a hiatus, and I was working through the troubleshooting guide to practice those steps for $reasons, and I opened up the web-console for the first time and found something moderately troubling. Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> 'unsafe-eval' <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.doubleclick.net <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.firebaseio.com <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.opentok.com <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> editor:8 Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> 'unsafe-eval' <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.doubleclick.net <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.firebaseio.com <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> https://*.opentok.com <a href="https://app.roll20.net" rel="nofollow">https://app.roll20.net</a> I've disabled both NoScript & Adblock Plus to make sure they weren't causing issues, and my cache was cleared. I searched the forums and found a similar issue reported, in conjunction with not being able to load the campaign screen. I'm not actively having any issues I'm aware of in my campaign, beyond voicecomm issues. In the other thread, it was suggested to look at my router. What specifically should I be asking my admin to look at? Where else should I be looking to eliminate this issue? TechSpecs: FireFox 35.0.1; Windows 7 Home Premium Service Pack 1; Javascript enabled; No anti-virus software beyond Adblock Plus; Addons: Classic Theme Restorer, Googlebar Lite, Restartless Restart, Simple Clocks, Tab Kit 2nd Edition
1423927779
Lithl
Pro
Sheet Author
API Scripter
Content Security Policy is part of your browser, not your router, with certain things getting locked out based on the Content Security Policy header sent by Roll20 when you load the page (if it gets sent). The CSP is designed to protect you against cross-site scripting attacks. I don't believe there's anything you can do on your end of things to change what gets blocked by the CSP (IIRC the NoScript add-on can let you be more restrictive, but not less so).
You can ignore those errors. We use Content-Security-Policy to block a lot of the cruft that some people's computers have running (basically we have to "sign" all script that runs on the page, making it more secure). We have some tracking code installed on our server to track things like how quickly pages are loading (so we can notice when the servers are responding slowly)...unfortunately it's not compatible with that, but we don't currently have a way to turn it off for just that page. So basically, you can just ignore those errors.
1423928652
Gen Kitty
Forum Champion
Ok then. Consider this Resolved! (I know you love easy fixes!)