[Custom Hubs Cloud] Content Security Policy blocked

[Orics]

Hi.
After we customize hub cloud and deploy according to instructions: https://hubs.mozilla.com/docs/hubs-cloud-custom-clients.html .
We want to try calling the API from another domain but it doesn't work.
This is error message:
Refused to connect to 'https://vdc-dev.gemiso.com/larchiveum/v1/exhibitions?page=1&pageSize=9&sort=startDate|asc' because it violates the following Content Security Policy directive: "connect-src 'self' blob: data: https://api.github.com https://bh4d9od16a-3.algolianet.com https://cdn.aframe.io https://dpdb.webvr.rocks https://www.google-analytics.com https://www.youtube.com https://fonts.gstatic.com https://hubs-dev-01-cors-proxy.larchiveum.link:443 https://larc.link:443 https://.larchiveum.link:443 wss://.larchiveum.link:443 wss://.larchiveum.link:8443 https://.larchiveum.link:8443 https://hubs-dev-01-assets.larchiveum.link https://hubs-dev-01-nearspark.larchiveum.link".

[matthewbcool]

Take a look at the admin panel Server settings --> Advanced. There are fields there to add CSP rules to page headers.

[SamanthaZH]

I add a CSP connect-src in my hubs, after that, I cannot access hubs anymore. It seems very like my HC instance has been blocked after I add allowed Cors.

[hrithikwins]

Adding CSP is entirely different from Adding CORS rules,
In CORS rules, you add a comma separated links, and you have to include your other links as well, so suppose you want one extra link, you'd be adding up 3 links in total (your https://examplehubs.com,https://example.link,https://newlink.com )

Go to your-cloud/admin#/server-setup, then click on advanced tab
But when adding CSP, you have to add only the new link you want (and they should be space-separated instead of comma-separated)
It contains various types like
| script-src Rules | Here you add the new urls which you see are sending Javascript over the cdn |

• font-src Rules: The links you want to add for serving the fonts
• style-src Rules: Your css files
• connect-src Rules: must have all of the other links which you want to connect, like the urls you're going to use for rest or websocket
• frame-src Rules: If you're embedding twitch vimeo or any other thing, the link should be here
• worker-src Rules
• child-src Rules
• img-src Rules: Image CDNs you're using
• media-src Rules: if you're playing the media in your iframe, you need to add it to frame-src as well as here again
• manifest-src Rules
• form-action Rules

[SamanthaZH]

It works now. Thanks.

[matthewbcool]

Great! more on CSP here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src