title: Content-Security-Policy suddenly stopped working while using the app
body: <p>I'm working on a Cordova app for months and I've never had any problem with the Content-Security-Policy after setting it the way I wanted, months ago.</p>
  
  <p>My app connects to the server when I launch it. It's the same server for months.</p>
  
  <p>But today it suddenly stopped working while I was using the app. My app crashed (first time it happens) then when I relaunched it, I had the CSP error when trying to connect to the server.</p>
  
  <p>I didn't change the CSP, I wasn't even working on that at all. </p>
  
  <p>I tried restarting my phone and the server but it didn't solve the problem.</p>
  
  <p>So the address I want to connect to is something like <code>http://my.random.address.com:40017/4DSOAP</code></p>
  
  <p>My CSP is <code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' http://*/4DSOAP https://*/4DSOAP" /&gt;</code>.</p>
  
  <p>As I said it worked perfectly fine for months, I'm connecting to the server hundreds of times per week, including dozens of times just for today.</p>
  
  <p>Now if I change the CSP to <code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' http://my.random.address.com:40017/4DSOAP https://*/4DSOAP" /&gt;</code> (so the exact address I'm trying to reach), it works. But this is not what i want because it can be another port or even another address.</p>
  
  <p>The error on Chrome Debug is:</p>
  
  <blockquote>
    <p>Refused to connect to '<a href="http://my.random.address.com:40017/4DSOAP" rel="nofollow noreferrer">http://my.random.address.com:40017/4DSOAP</a>' because it violates the following Content Security Policy directive: "default-src 'self' http:// * /4DSOAP https:// * /4DSOAP". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>
  
  <p>Is it possible my phone made an update when I was using the app, an update that changed the webview and the way CSP work (maybe asterisks not allowed anymore or working differently)?</p>