Strapi + Digital Ocean Spaces on localhost (CORS issue)

[matijamatija]

Hello, In order to make the strapi-provider-upload-do work on localhost I had to customize the strapi::security in middlewares.js. Otherwise, all the links in the preview would be broken.

I used this config:

  {
    name: 'strapi::security',
    config: {
      contentSecurityPolicy: {
        useDefaults: true,
        directives: {
          'connect-src': ["'self'", 'https:'],
          'img-src': [
            "'self'",
            'data:',
            'blob:',
            'dl.airtable.com',
            'MY-DO-SPACES-URL.digitaloceanspaces.com',
          ],
          'media-src': [
            "'self'",
            'data:',
            'blob:',
            'dl.airtable.com',
            'MY-DO-SPACES-URL.digitaloceanspaces.com',
          ],
          upgradeInsecureRequests: null,
        },
      },
    },
  },

Questions:

• Should this be added to the docs?
• Is this the correct config?
• Is this a security concern?
• Is this needed only locally or also for production? (Haven't been able to deploy yet, so I'm not sure. Will update when I do.)

[shorwood]

I'm not sure I understand where the issue is comming from or even what is the precise issue you are facing.

Feel free to provide a log, stack trace or better yet a codesandbox / jsfiddle example; And I will look into it.

Regards, Stanley.

[matijamatija]

I think we can close this. After further investigation, I've found this in the strapi docs: https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/required/middlewares.html#internal-middlewares-configuration-reference

Example from the docs:

// path: ./config/middlewares.js

module.exports = [
  // ...
  {
    name: 'strapi::security',
    config: {
      contentSecurityPolicy: {
        useDefaults: true,
        directives: {
          'connect-src': ["'self'", 'https:'],
          'img-src': [
            "'self'",
            'data:',
            'blob:',
            'dl.airtable.com',
            'yourBucketName.s3.yourRegion.amazonaws.com',
          ],
          'media-src': [
            "'self'",
            'data:',
            'blob:',
            'dl.airtable.com',
            'yourBucketName.s3.yourRegion.amazonaws.com',
          ],
          upgradeInsecureRequests: null,
        },
      },
    },
  },
  // ...
]

So looks like it's safe to use.

Btw. for anyone encountering this in the future, I also had to customize strapi::query in order to get it working (per the example in docs).

@shorwood thanks for checking the issue.

[shorwood]

Noted,

I'm closing the issue. Feel free to reopen if it was indeed an issue with the package.