Content Security Policy of your site blocks some resources #16760

caubenganha · 2023-02-01T08:06:39Z

caubenganha
Feb 1, 2023

Before reporting an issue

I have searched existing issues
I have reproduced the issue with the latest release

Area

admin/ui

Describe the bug

When I click "Administration Console" icon in Keycloak main page https://my-keycloak.com.vn (public domain) I have got the error as follows:

Some resources are blocked because their origin is not listed in your site's Content Security Policy (CSP). Your site's CSP is allowlist-based, so resources must be listed in the allowlist in order to be accessed.
A site's Content Security Policy is set either as via an HTTP header (recommended), or via a meta HTML tag.
To fix this issue do one of the following:
(Recommended) If you're using an allowlist for 'script-src', consider switching from an allowlist CSP to a strict CSP, because strict CSPs are more robust against XSS . See how to set a strict CSP .
Or carefully check that all of the blocked resources are trustworthy; if they are, include their sources in the CSP of your site. ⚠️Never add a source you don't trust to your site's CSP. If you don't trust the source, consider hosting resources on your own site instead.

http://my-keycloak.com.vn	bị chặn	frame-src	index.0cb2e516.js:90

Version

quay.io/keycloak/keycloak:latest

Expected behavior

I can move to login keycloak admin page with username and passord form

Actual behavior

The page has been loading forever with the above error

How to Reproduce?

Set update public domain https://my-keycloak.com.vn for internal ip address 123.45.6.78
Run Keycloak in tls mode at port 8443:8443 docker container
Go to https://my-keycloak.com.vn and login to keycloak with credentials info
Keycloak login page can not be loaded

Anything else?

http://my-keycloak.com.vn blocked frame-src index.0cb2e516.js:90

Anyone can help me? Thanks

dzintars · 2023-04-27T20:02:29Z

dzintars
Apr 27, 2023

Yeah, not sure how does that work

I am behind proxy TLS termination, and this is very single application where I see this.
From http://localhost:8080 it works just fine. So... most likely I need to tweak my proxy config for KC backend.

1 reply

dzintars Apr 27, 2023

This one seems to do something at least in my case. Its absolutely weird, that diferen ENV naming conventions are used.

Navigation Menu

Repository navigation

Content Security Policy of your site blocks some resources #16760

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Content Security Policy of your site blocks some resources #16760

Uh oh!

Uh oh!

caubenganha Feb 1, 2023

Before reporting an issue

Area

Describe the bug

Version

Expected behavior

Actual behavior

How to Reproduce?

Anything else?

Replies: 1 comment · 1 reply

Uh oh!

Uh oh!

dzintars Apr 27, 2023

Uh oh!

dzintars Apr 27, 2023

caubenganha
Feb 1, 2023

Replies: 1 comment 1 reply

dzintars
Apr 27, 2023