CSP Manager

Questions
1

Hi,

I am seeing the following errors in the Development tools, I added it connection-src and default-src, but when I try and login it still bounces between the frontend and the back office, in an infinite loop.

ws://localhost:21260/Umbraco/
wss://localhost:44376/Umbraco/

https://localhost:44343/umbraco/management/api/v1/server/status

https://localhost:44343/umbraco/management/api/v1/server/configuration

https://localhost:44343/umbraco/management/api/v1/manifest/manifest/public

https://localhost:44343/umbraco/management/api/v1/security/back-office/login

Any Ideas???

2

What version are you using? What browser? Did you clear the browser cache?

@MattW

3

Hi @darrenhunterEmerald,

Can you please do a quick test:
Temporarily disable your CSP entirely in code. If the loop stops, you know it’s a connect-src or script-src issue. If the loop continues, the problem is Authentication Persistence (Cookies handshake).

4

Hi,

I have switched off the header and I can get back in. I just need to know which one I need to remove or what I need to add to stop the loop.

5

I am using the latest 17 build and latest CSP Manager build.

6

@darrenhunterEmerald Can you please try this once:

default-src ‘self’
script-src ‘self’ ‘unsafe-inline’ ‘wasm-unsafe-eval’ ‘strict-dynamic’ ‘nonce’
connect-src ‘self’ https://localhost:44343 ws://localhost:21260 wss://localhost:44376
form-action ‘self’
frame-ancestors ‘self’
7

Hi all,

In case this happens again, you are able to disable the Umbraco header via an appsetting no need to use code.

Troubleshooting | CSP Manager for Umbraco

If you nee the default backoffice CSP again, if you set up a fresh site and use the new import feature, you can copy it from the evaluation tab and import back into your site.

Thanks
Matt

8

Hi,

I have done that and got back in, I have removed all ref to local host and it working as expected again. Took out the over ride in the appsetting and the site behaving as normal. I guess it was some thing I added to do woth local host.