Why does the Google log-in fail with http-headers?答案

【问题标题】：Why does the Google log-in fail with http-headers?Why does the Google log-in fail with http-headers?
【发布时间】：2022-12-02 06:23:40
【问题描述】：

Currently I'm working on an application with a frontend and backend. I want to implement secure http-headers, especially Content Security Policy. But now the problem is, that the Google Sign In doesn't work anymore. As soon as I can choose which Account to log-in nothing happens anymore.

I've added HelmetJS and changed these CSP setting in my backend with ExpressJS:

defaultSrc: [
          "'self' 'unsafe-inline' 'unsafe-eval' 'www.google.com' 'www.gstatic.com'",
        ],
        scriptSrc: [
          '"self" "unsafe-eval" "unsafe-inline" "google" "*.google" "*.google.com" "*.googleapis.com"',
        ],

I tried adding google to allowed domains but it didn't work.

【问题讨论】：

Try flipping the single and double qoutes for scriptSrc. If it doesn't help include some error messages.

标签： express http-headers content-security-policy helmet.js

【解决方案1】：

It looks like you're quoting things you shouldn't. Things like "self" and "unsafe-inline" should be quoted, but others shouldn't.

Try this:

defaultSrc: [
  // Should be quoted
  "'self'", "'unsafe-inline'", "'unsafe-eval'",
  // Shouldn't be quoted
  "www.google.com", "www.gstatic.com",
],
scriptSrc: [
  // Should be quoted
  "'self'", "'unsafe-eval'", "'unsafe-inline'",
  // Shouldn't be quoted
  "*.google", "*.google.com", "*.googleapis.com",
],

【讨论】：