Content Security Policy directive error

[laclance]

I have tried a bunch of security policies to connect to our api but always get refused, only on v4.

Refused to connect to 'https://myapi...' because it violates the following Content Security Policy directive: "connect-src 'self' https://myapi.../* 'unsafe-inline' 'unsafe-eval'".

export function setupContentSecurityPolicy(customScheme: string): void {
  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
    callback({
      responseHeaders: {
        ...details.responseHeaders,
        'Content-Security-Policy': [
          electronIsDev
            ? `default-src ${customScheme}://* https://myapi.../* 'unsafe-inline' devtools://* https://myapi.../* 'unsafe-eval' data: https://myapi.../*; script-src 'self' https://myapi.../* 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://myapi.../* 'unsafe-inline' 'unsafe-eval';`
            : `default-src ${customScheme}://* 'unsafe-inline' data:`
        ]
      }
    });
  });
}

v4.0.3 Chrome 94 Windows 10 React 17

[schwenkreis]

Just try https://myapi.../ (no * after the final slash)

[laclance]

thanks, ya it seems * is only a prefix not a suffix.

[laclance]

is there a way to dynamically edit the policy? I will open up a new issue. https://github.com/capacitor-community/electron/issues/150