Trouble with Content Security Policy

[DarkShyMW]

Steps to reproduce the problem

Hello!
I was install mastodon on clear debian server.
When I logged into my account for the first time - everything was fine, after that I decided to check from my phone - a white page opened without any content.
After that, I logged out of my PC account and saw the same white screen.
In console:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https://bronyfurry.com". Either the 'unsafe-inline' keyword, a hash ('sha256-VgAdUhL1FabDOMlyP5PHEqy0KxxjG1nQBuqXlYPNwVs='), or a nonce ('nonce-...') is required to enable inline execution.
Failed to find a valid digest in the 'integrity' attribute for resource 'https://bronyfurry.com/packs/js/application-d735d94afb9092eeeb5e.chunk.js' with computed SHA-256 integrity 'e6746tuillKCb87cCcrrqOLAsJT9edD9RLTxF3HnQgg='. The resource has been blocked.

and same errors. When i clear cache, sites works 1-2 minutes and down again.
you can try to watch it:
https://bronyfurry.com/

Expected behaviour

Stable sites work

Actual behaviour

SCP doesnt allow part of a Content

Specifications

Debian 11

[ykzts]

Are you using a CDN (e.g. Cloudflare) that automatically optimizes your JavaScript and CSS? Mastodon is not compatible with auto-optimization because it hashes the JavaScript and CSS content to make sure they match.

[DarkShyMW]

Are you using a CDN (e.g. Cloudflare) that automatically optimizes your JavaScript and CSS? Mastodon is not compatible with auto-optimization because it hashes the JavaScript and CSS content to make sure they match.

You mean "Auto minify"?

[ykzts]

You mean "Auto minify"?

The terminology used to describe "automatically optimizes" varies among CDN providers. Cloudflare uses the term, but your CDN may use a different term.

[rmaureira]

I'm having the same issue

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://seda.social 'nonce-lzozYVDDDh97xugsi9xxRw=='". Either the 'unsafe-inline' keyword, a hash ('sha256-7tsmGaw+rilRAyeDpgSgI1BtB1Cj9tGH8tjHKYTiDaE='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

I am using a CDN, but I don't have any of those optimizations enabled.

My errors are prepended with a warning first

Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

[akhepcat]

I'm also having the same issue as OP and @rmaureira

I'm not using a CDN, I'm viewing directly on the same subnet as my server.

This is the console error log when I freshly load the page:

1. Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

2. Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://mastodon.akhepcat.com 'nonce-Yhr2p3I5IppvCotXgddiaA=='". Either the 'unsafe-inline' keyword, a hash ('sha256-7tsmGaw+rilRAyeDpgSgI1BtB1Cj9tGH8tjHKYTiDaE='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

3. Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://mastodon.akhepcat.com 'nonce-Yhr2p3I5IppvCotXgddiaA=='". Either the 'unsafe-inline' keyword, a hash ('sha256-7tsmGaw+rilRAyeDpgSgI1BtB1Cj9tGH8tjHKYTiDaE='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

4. A preload for 'https://mastodon.akhepcat.com/packs/js/features/compose-a4a2cbc8f8141609dcdc.chunk.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.

5. A preload for 'https://mastodon.akhepcat.com/packs/js/features/home_timeline-31e11861bf98ef605799.chunk.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.

6. [Violation] Added non-passive event listener to a scroll-blocking event. Consider marking event handler as 'passive' to make the page more responsive. scrollable_list.js:243 See https://www.chromestatus.com/feature/5745543795965952

7. Notifications permission has been blocked as the user has ignored the permission prompt several times. This can be reset in Page Info which can be accessed by clicking the lock icon next to the URL. See https://www.chromestatus.com/feature/6443143280984064 for more information.

8. The resource https://mastodon.akhepcat.com/packs/js/features/compose-a4a2cbc8f8141609dcdc.chunk.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate as value and it is preloaded intentionally. [18 more URLs removed)

[danorton]

@akhepcat any resolution? If not, I’ll open another issue.

[akhepcat]

Ah, hadn't seen that a new version had been released. I'll have to schedule the upgrade, but I'm about to head out on vacation, so it'll have to wait a bit for me to get some free time to work on it.

[akhepcat]

The errors 1-3 have disappeared, now that i'm on 4.1.2

The preload warnings 4-8 still show up in the console, but i'm not sure how critical those preloads really are.