Content Security Policy seemingly absent from new instance

[antpb]

From https://github.com/mozilla/hubs/discussions/2994

After changing the admin settings for content-src and script-src I am seeing CORS errors even after deleting an instance and creating a fresh new one. (Param store has been untouched by me)

Example error below:

Refused to prefetch content from 'https://bp-hubs-main-assets.brokenplace.com/spoke/assets/js/vendors~package-kit-page~project-page-f6be3132b65e15548183.js' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'prefetch-src' was not explicitly set, so 'default-src' is used as a fallback.

Also from the discussion, prior to a fresh instance, I was seeing

Content Security Policy: The page’s settings blocked the loading of a resource at https://bp-hubs-assets.<internaldomain>.com/...

You can see the error in Spoke or in a room at the following Hubs Cloud instance: https://hubs.broken.place

The above instance is currently in line with the hubs-cloud branch.

┆Issue is synchronized with this Jira Task

[antpb]

I notice that my internal domain is not in the new stacks Cors params. Should it be? Here’s what it looks like currently

CorsOrigins	https://hubs.broken.place,https://bpxr.link,https://hubs.local:8080,https://localhost:8080

[antpb]

Last night I deleted the stack, removed all rogue DNS records, then made a new stack. Still seeing the same issues. The example url is now 1:1 with what deploys from an initial stack creation.

[antpb]

You can reproduce the error most clearly by going to https://hubs.broken.place/spoke and making a new scene. When you've reached the new scene, add a video element and use a youtube/vimdeo url and you'll notice that videonode fails.

[antpb]

In another self hosted instance I have access to I noticed that in Spoke the same errors are happening so this seems across all Hub Cloud instances. Existing content seems to be okay, it's just new content that is not working. Maybe the problem is Spoke side? The common issue seems to be the proxy domain not being able to resolve.

I've seen similar reports to this issue in https://github.com/mozilla/hubs/discussions/3017 and https://github.com/mozilla/hubs-cloud/issues/110

[antpb]

oh, worth noting this is also happening on hubs.mozilla.com/spoke :O

edit: Had some time this evening to compare to my Hub Cloud instance. What stands out the most is the content security policy errors happening around google analytics. Seemingly every external source is throwing issue.

Here's a snippet of the google analytics error in the Mozilla Spoke instance:

Refused to connect to 'https://www.google-analytics.com/REALLYLONGSTRING' because it violates the following Content Security Policy directive: "connect-src https://hubs.link https://hub.link https://sentry.prod.mozaws.net https://assets-prod.reticulum.io https://uploads-prod.reticulum.io https://smoke-assets-prod.reticulum.io https://asset-bundles-prod.reticulum.io https://smoke-asset-bundles-prod.reticulum.io https://hubs-proxy.com wss://hubs.mozilla.com wss://smoke-hubs.mozilla.com https://www.mozilla.org https://hubs.local:3000 'self' https://cors-proxy-prod.reticulum.io:443 https://uploads-prod.reticulum.io https://dpdb.webvr.rocks https://nearspark-prod.reticulum.io:443 https://*.reticulum.io:443 wss://.reticulum.io:443 wss://.reticulum.io:443 https://*.reticulum.io:443 wss://:443 https://:443 https://cdn.aframe.io https://www.youtube.com https://api.github.com data: blob:".

[GBR-422777]

I am having the same logs issue, any solution here? However my problem is different, I tried on 2 different AWS Hubs personal accounts, one some network connections in France and Lebanon, I get the following errors, whenever I create a room and wait for it to load:

After waiting, the following error is displayed, same issue happens if I click on try connecting with TCP link:

[chandeepadissanayake]

Reproducing this on DigitalOcean. (Even in Spoke)