`content-security-policy: default-src https:;` blocks resource loading at inline 1:1 [closed] - http-headers

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 3 years ago.
Improve this question
I have set Content-Security-Policy: default-src https:; report-uri https://rootkea.report-uri.com/r/d/csp/enforce on https://csp.rootkea.me/
Whenever I visit the website, the console says:
Content Security Policy: The page’s settings blocked the loading of a
resource at inline (“default-src”). rootkea.me:1:1
At 1:1 I have <!DOCTYPE html> as can be seen from the source:
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="generator" content="GitLab Pages">
<title>Plain HTML site using GitLab Pages</title>
<link rel='stylesheet' href='https://d33wubrfki0l68.cloudfront.net/css/ec5b55aee5efed4317d1380a75fc4c3df003f096/style.css'/>
</head>
<body>
<div class="navbar">
Home
Blog
</div>
<h1>Hello World!</h1>
</body>
</html>
So, what am I missing?

Poor debugging on my part. I should've debugged in fresh Firefox profile first.
Anyways, the culprit was the Google Analytics Opt-out Add-on (by Google) addon. I disabled it and no more CSP error in console.

Related

Unable to scrape parts of a page webpage with scrapy

I'm using scrapy to crawl an e-commerce website I'm experienced with simpler websites where scrapy alone or with splash/selenium handle most cases.
I have a new situation where I have no experience to deal with. From my investigations it could be like a captcha but without any request to the user.
I've made tests to solve it with scrapy alone, scrapy and selenium with no success.
With my scrapy request I receive the following response
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<title>Challenge Validation</title>
<link rel="stylesheet" type="text/css" href="/_sec/cp_challenge/sec-2-9.css">
<script type="text/javascript">function cp_clge_done(){location.reload(true);}</script>
<script src="/_sec/cp_challenge/sec-cpt-int-2-9.js" async defer></script>
<script type="text/javascript">sessionStorage.setItem('data-duration', 5);</script>
</head>
<body>
<div class="sec-container">
<div id="sec-text-container"><iframe id="sec-text-if" class="custmsg" src="https://beta.elcorteingles.es/sgfm/statics/eci_non_food/contents/cc/cca.html"></iframe></div>
<div id="sec-if-container">
<iframe id="sec-cpt-if" class="crypto" data-key="" data-duration=5 src="/_sec/cp_challenge/ak-challenge-2-9.htm"></iframe>
</div>
</div>
</body>
</html>
With the chrome inspector i see also noticed two GET requests (non-java) that might be related:
check -> returns HTML ( ... <title>RP iframe</title> ...)
check-session?origin=https%3A%2F%2Fwww.elcorteingles.es -> returns HTML (...<title>OP iframe</title>...)
Using scrapy shell with view(response) it looks like a captcha situation, waiting for something. Page example could be:
scrapy shell "https://www.elcorteingles.es/supermercado/0110120903000022-coosur-aceite-de-oliva-intenso-1-botella-1-l/"
The title 'challenge validation' suggests it. I have no idea how to handle with this case. From research, I've seen solutions involving scrapy middleware but for cases where input was asked from the user. I found no example similar to this case. Any guidance on how to proceed is appreciated.

Permalinks vs pretty URLs

Let's say i have a simple blog engine. I've posted a simple post with URL
http://example.org/blog/awesomr-post
Few days later i've noticed the typo and fix my URL
http://example.org/blog/awesome-post
But search engines have already indexed "awesomr-post" and if somebody follow this link he'll get 404 error. There is the same issue with bookmarked pages.
So i think the post should be accepted by two links
http://example.org/blog/awesome-post
http://example.org/permalinks/1
Now i have to specify relationships somehow. What i can do
http://example.org/permalinks/1
<!DOCTYPE html>
<html>
<head>
<link rel="canonical" href="http://example.org/blog/awesome-post">
</head>
<body>
page content
</body>
</html>
http://example.org/blog/awesome-post
<!DOCTYPE html>
<html>
<head>
<link rel="bookmark" href="http://example.org/permalinks/1">
</head>
<body>
page content
</body>
</html>
Is it right solution? And should i use the canonical or permalink URL when linking from another site pages?
One of the way is to have 301 (permanent) redirect from http://example.org/blog/awesomr-post to http://example.org/blog/awesome-post

how to set canonical url with bitly [closed]

Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I can use the bit.ly for shorten url in canonical?
In terms of seo, right?
for example :
<link rel="canonical" href="<?php echo $post->og('bitly'); ?>" />
and
<meta property="og:url" content="<?php echo $post->og('bitly'); ?>" />
or
<link rel="canonical" href="<?php echo $post->og('url'); ?>" />
url : http://domain/post/title
bitly: http://bit.ly/3tcJjx
Which is correct?
Thank
You cannot set the canonical URL to a shortened URL or any URL that redirects.
In many ways, Google sees a canonical as equivalent to a redirect. When you specify a canonical URL, it tells Googlebot, "Don't index the content on this URL, go here and index the content here instead." Then when Google gets to bit.ly, it finds that it redirects back and heads right back. The logic is that of an infinite redirect.
Your canonical URL must be a URL that actually contains the content. It cannot be a URL that redirects to the content.

Sniff and modify URL requests coming from UIWebViewController

I have one html page open inside UiWebViewController with cordova. While index.html loading inside the Uiwebviewcontroller can we sniff the requests that is originating from index.html?
for example I have following html that is getting opened in UiWebviewcontroller:
<html>
<head>
<link rel="stylesheet" type="text/css" href="theme.css">
<script src="app.js"></script>
</head>
<body>
<img src="img.jpg"/>
</body>
</html>
Can I sniff and modify the url that is getting requested inside Uiwebviewcontroller ie. img.jpg,theme.css,app.js to something like content/img.jpg, css/theme.css, js/app.js using Objective-C.
Yes, that’s possible using NSURLProtocol, see this blog post by NSHipster and this related Stack Overflow thread.

How to display a favicon for web app using Tomcat? [duplicate]

This question already has answers here:
How to add a browser tab icon (favicon) for a website?
(13 answers)
Closed 6 years ago.
Does anyone know how to implement a favicon icon for a particular application using Tomcat? This icon file would not be for all webpapps, just this one on the server in question.
Just add the following code in the <head> to your index.html in you webapp/projectName/
<link rel="shortcut icon"
href="http://example.com/myicon.ico" />
I like to add that the original tag type for the link was "shortcut icon", but that didn't
conform to the standard so it was sort of switched to "icon".
So I recomend add both to your head block:
<link rel="icon" href="http://www.example.com/favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="http://www.example.com/favicon.ico" type="image/x-icon">
Also some browsers don't support sizes other than 16px X 16px.
Delete or rename tomcat/webapps/ROOT/favicon.ico and Tomcat will look for a favicon.ico in the root of each web app that it serves. You don't need to put a into the head section of each page.
<link rel="shortcut icon" href="http://example.com/myicon.ico" />
add that within the <head> of your page - where the .ico file is an icon - there are several websites (use google) that generate .ico files from pictures (gif / jpeg etc)