CSP error when running sample code on "How to use promises" page

[ubergraham]

MDN URL

https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Asynchronous/Promises

What specific section or headline is this issue about?

Error in the Javascript

What information was incorrect, unhelpful, or incomplete?

Incorrect

What did you expect to see?

Correct Javascript code in the Browser Console

Do you have any supporting links, references, or citations?

You're supposed to be able to run this code

const fetchPromise = fetch('https://mdn.github.io/learning-area/javascript/apis/fetching-data/can-store/products.json');

console.log(fetchPromise);

fetchPromise.then((response) => {
  console.log(`Received response: ${response.status}`);
});

console.log("Started request…");

And get

Promise { <state>: "pending" }
Started request…
Received response: 200

But instead you get a CORS error:

[Error] Refused to connect to https://mdn.github.io/learning-area/javascript/apis/fetching-data/can-store/products.json because it does not appear in the connect-src directive of the Content Security Policy.

Do you have anything more you want to share?

See above

MDN metadata

Page report details

* Folder: `en-us/learn/javascript/asynchronous/promises` * MDN URL: https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Asynchronous/Promises * GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/learn/javascript/asynchronous/promises/index.md * Last commit: https://github.com/mdn/content/commit/0c410538f50487e8b0f419e11e24ad5adb60bf36 * Document last modified: 2022-11-23T00:02:38.000Z

[wbamberg]

Which page are you running the code in? The page asks that you run the code in https://example.org/, which has a less restrictive policy.

[mirunacurtean]

@ubergraham Could you try it as suggested on example.org? I have, in Chrome, and got the expected result.

Which page are you running the code in? The page asks that you run the code in https://example.org/, which has a less restrictive policy.

[caugner]

This sounds like we should add mdn.github.io to the connect-src directive of our CSP config.