{"action":"created","issue":{"url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/38","labels_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/38/comments","events_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/38/events","html_url":"https://github.com/rwjblue/ember-cli-content-security-policy/issues/38","id":72185674,"number":38,"title":"\"script-src 'self'\" causes CSP violation with Ember inspector","user":{"login":"Awem","id":4180877,"avatar_url":"https://avatars.githubusercontent.com/u/4180877?v=3","gravatar_id":"","url":"https://api.github.com/users/Awem","html_url":"https://github.com/Awem","followers_url":"https://api.github.com/users/Awem/followers","following_url":"https://api.github.com/users/Awem/following{/other_user}","gists_url":"https://api.github.com/users/Awem/gists{/gist_id}","starred_url":"https://api.github.com/users/Awem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Awem/subscriptions","organizations_url":"https://api.github.com/users/Awem/orgs","repos_url":"https://api.github.com/users/Awem/repos","events_url":"https://api.github.com/users/Awem/events{/privacy}","received_events_url":"https://api.github.com/users/Awem/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-30T14:52:26Z","updated_at":"2016-01-27T13:04:17Z","closed_at":"2015-12-30T14:57:12Z","body":"Setting `contentSecurityPolicy: {'script-src': \"'self'\"}` on an Ember-CLI app causes a CSP violation, if that app is accessed on Windows (maybe also other OS) via latest stable Firefox with Ember Inspector addon installed. Here are the steps to reproduce:\r\n* On Windows (7) generate a new Ember app (latest ember-cli) and start: `ember serve --host localhost`\r\n* Add `contentSecurityPolicy: {'script-src': \"'self'\"}` to your `environment.js`\r\n* On latest stable Firefox install addon [Ember Inspector] (https://addons.mozilla.org/en-US/firefox/addon/ember-inspector/) (make sure that its tab appears at the inspector pane)\r\n* browse to `http://localhost:4200/`\r\n* you will get the CSP report. If not, click the reload button\r\n\r\nI know that adding `contentSecurityPolicy: {'script-src': \"'self'\"}` to `environment.js` doesn't really make sense, because that's the default setting anyway. But nevertheless I think that CSP violation shouldn't occur. By the way, it doesn't happen with Chrome + Ember Inspector. Here is the CSP report:\r\n```json\r\n{\"csp-report\":{\r\n  \"blocked-uri\":\"self\",\r\n  \"document-uri\":\"http://localhost:4200/\",\r\n  \"line-number\":58,\r\n  \"original-policy\":\r\n    \"script-src http://localhost:4200 http://localhost:35729 http://0.0.0.0:35729; \r\n     default-src 'none'; \r\n     font-src http://localhost:4200; \r\n     connect-src http://localhost:4200 ws://localhost:35729 ws://0.0.0.0:35729 http://localhost:4200/csp-report; \r\n     img-src http://localhost:4200; \r\n     style-src http://localhost:4200; \r\n     media-src http://localhost:4200; \r\n     report-uri http://localhost:4200/csp-report\",\r\n  \"referrer\":\"\",\r\n  \"script-sample\":\"call to eval() or related function blocked by CSP\",\r\n  \"source-file\":\"resource://gre/modules/commonjs/toolkit/loader.js ->\r\n                 resource://gre/modules/commonjs/sdk/loader/sandbox.js ->\r\n                 resource://ember-inspector-at-emberjs-dot-com/ember-inspector/data/content-script.js\",\r\n  \"violated-directive\":\"script-src http://localhost:4200 http://localhost:35729 http://0.0.0.0:35729\"\r\n}}\r\n```\r\nIf I remove `contentSecurityPolicy: {'script-src': \"'self'\"}`, the CSP violation doesn't occur any longer."},"comment":{"url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/comments/175609671","html_url":"https://github.com/rwjblue/ember-cli-content-security-policy/issues/38#issuecomment-175609671","issue_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/38","id":175609671,"user":{"login":"jelhan","id":4965703,"avatar_url":"https://avatars.githubusercontent.com/u/4965703?v=3","gravatar_id":"","url":"https://api.github.com/users/jelhan","html_url":"https://github.com/jelhan","followers_url":"https://api.github.com/users/jelhan/followers","following_url":"https://api.github.com/users/jelhan/following{/other_user}","gists_url":"https://api.github.com/users/jelhan/gists{/gist_id}","starred_url":"https://api.github.com/users/jelhan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jelhan/subscriptions","organizations_url":"https://api.github.com/users/jelhan/orgs","repos_url":"https://api.github.com/users/jelhan/repos","events_url":"https://api.github.com/users/jelhan/events{/privacy}","received_events_url":"https://api.github.com/users/jelhan/received_events","type":"User","site_admin":false},"created_at":"2016-01-27T13:04:17Z","updated_at":"2016-01-27T13:04:17Z","body":"Doesn't seem to be fixed. I'm still getting CSP violation in firefox 43.0.4 (ubuntu).\r\n\r\nember-inspector 1.9.4\r\n\r\nSteps to reproduce (using ember-cli 1.13.14):\r\n```\r\n$ ember new testCSP\r\n$ cd testCSP\r\n$ ember install ember-cli-content-security-policy@0.5.0\r\n$ ember server\r\n```\r\n\r\n@rwjblue please reopen."}}