Next.js Discord

Discord Forum

Content security policy issue when accessing via domain

Unanswered
Spectacled bear posted this in #help-forum
Open in Discord
Spectacled bearOP
My website doesnt have any issues when acessing it via the ip:port but when i access it via my website it doesnt now, I jus finished coding it and connected it to my domain via nginx reverse proxy and cloudfare it shows a black screen and shows this in the brower console

72 Replies

need to add unsafe-eval on script-src
@Ray Do you have CSP setup?
Spectacled bearOP
sorry, whats a csp ?
Ray
Content security policy
@Ray Content security policy
Spectacled bearOP
how do I check that
Ray
I don't know where you set it? either middleware or next.config.js
@Ray I don't know where you set it? either middleware or next.config.js
Spectacled bearOP
I dont use any middleware
Ray
check next.config.js then
@Ray check next.config.js then
Spectacled bearOP
Ray
oh maybe you set it in nginx?
@Ray oh maybe you set it in nginx?
Spectacled bearOP
oh nginx
Ray
look for Content-Security-Policy header
@Ray look for Content-Security-Policy header
Spectacled bearOP
oh here i see one
so remove them ?
Ray
add script-src 'self' 'unsafe-eval' 'unsafe-inline' to it
Spectacled bearOP
okay
@Ray add `script-src 'self' 'unsafe-eval' 'unsafe-inline'` to it
Spectacled bearOP
Ray
could you show the config of nginx?
it should be one line
Spectacled bearOP
oh wait i found the issue
done
Ray
does it fix?
Spectacled bearOP
nope
still the same
Ray
show the nginx config
Spectacled bearOP
Ray
you have two Content-Security-Policy, try combine them into one
Spectacled bearOP
how ?
Ray
can you copy and paste the value here
Spectacled bearOP
sure
Ray
i dont want to type them all😆
Spectacled bearOP
lol np
@Ray there u go
Ray
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; frame-ancestors 'self';" always;
Spectacled bearOP
oh ok
Ray
just updated
Spectacled bearOP
oh
done
Ray
does it work now
Spectacled bearOP
u can check this site as well: https://test.roverbot.xyz/
oh damn the site broke
Ray
very slow
@Ray very slow
Spectacled bearOP
didnt load yet ?
Ray
loaded
by no css
Spectacled bearOP
uhh reload
Ray
same
you can load it?
Spectacled bearOP
yeah
it loads but with errors
fixed that np
Ray
fixed?
Spectacled bearOP
yeah
Ray
I still can't load it'
@Ray I still can't load it'
Spectacled bearOP
ufff
Ray
add_header Content-Security-Policy  "default-src 'self' http: https: data: blob: 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src * blob: data:; media-src 'none'; connect-src *; font-src 'self' data:; frame-ancestors 'self';" always;

try change this
Spectacled bearOP
it works for me tho
lemme add that too
Ray
oh wait this is on dev mode?
Spectacled bearOP
yeah
Ray
lol
well ok
Spectacled bearOP
and yeah my friend ended up removeing the _app.js cuz he thought it was created by mistake
and the site is broken
Ray
try again later when you build production
ok
Spectacled bearOP
sure 👍