Cordobo / angularx-qrcode

A fast and easy-to-use Angular QR Code Generator library with Ivy support
https://cordobo.github.io/angularx-qrcode/
MIT License
459 stars 127 forks source link

content security policies violation issue #196

Closed serdec closed 1 year ago

serdec commented 1 year ago

Description

when displaying the qrcode i got an error in the console like the following:

Refused to connect to 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADwCAYAAAA+VemSAAAAAXNSR0IArs4c6QAAEORJREFUeF7tne1y5UYOQ9fv/9DeyniqxsnYBiiwebulk7/iBwASoq6zW3l7f39//x//oAAKHKnAGwY+cm6ARoFfCmBgFgEFDlYAAx88PKCjAAZmB1DgYAUw8MHDAzoKYGB2AAUOVgADHzw8oKMABmYHUOBgBTDwwcMDOgpgYHYABQ5WAAMfPDygowAGZgdQ4GAFMPDBwwM6CmBgdgAFDlYAAx88PKCjAAZmB1DgYAUw8MHDAzoKYGB2AAUOVgADHzw8oKMABmYHUOBgBTDwwcMDOgpgYHYABQ5WAAMfPDygowAGZgdQ4GAFMPDBwwM6CmBgdgAFDlYAAx88...' 
because it violates the following Content Security Policy directive: "connect-sr..."

I presume that this is due to some fetching for the download of the code, would it be possible to add a parameter to skip this?

Cordobo commented 1 year ago

Hi @serdec

first things first, angularx-qrcode does NOT download or fetch any additional code.

Could you provide me with some addtional data, like your angular version and a strapped-down version of your working code in a repo so I can investigate?

thanks!

serdec commented 1 year ago

hi @Cordobo, thanks for your quick reply.

This happens because i have restricted content security policies on my web application like the following

`connect-src 'self' 'unsafe-inline'  *.website1.com *.website2.com ... ; ` +

these are the errors i get in the console

image image

my code looks like

    <div *ngIf="qrCode">
      <qrcode [qrdata]="otpauth://totp/testaccount?secret=${secretCode}" [width]="240" [errorCorrectionLevel]="'M'"></qrcode>
    </div>

my angular version is 14.2.3 and the angularx-qrcode is 14.0.0

Cordobo commented 1 year ago

Hello @serdec

unfortunately I do not have the time to work on this right now because of my "day job", but I would be more than happy to review and merge a PR.

Feel free to open one with your changes against the development branch.

Thanks