search

stackernews / stacker.news

Internet communities that pay you Bitcoin
https://stacker.news
MIT License
424 stars 106 forks source link

LNC failing in prod due to CSP #1116

Closed huumn closed 1 month ago

huumn commented 5 months ago

https://stacker.news/items/520971/r/k00b?commentId=522044

Getting this error: invalid config: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:

ekzyis commented 5 months ago

Mhh, the last time we received CSP reports from stackers because NWC didn't work for them it was a false alarm. It ended up being a missing space. See https://github.com/stackernews/stacker.news/issues/821 and https://github.com/stackernews/stacker.news/pull/845.

But I think the context is different here since in the previous case, it worked with some NWC wallets and here everyone is running the same application. If it's CSP here, it should fail for all stackers since even old browsers which don't support CSP Level 3 (strict-dynamic and nonces) should still respect our CSP and fallback to unsafe-inline and thus run into this error.

So would be nice to know if LNC works for anyone in prod

huumn commented 5 months ago

I intended to get mine setup today, but as is my fashion, I gave myself too much to do.