Content security policy error log in UI

[mobyvb]

This issue appears in unclear conditions. See conversation below for details.

AC:

• there are no content security policy issues in the UI in any browser

[VitaliiShpital]

CSP error is thrown only on auth pages i.e. login, signup or forgot-password. Also, this error is thrown on v1 app auth pages too. I suspect it's related to hcaptcha

[mobyvb]

@VitaliiShpital https://satellite.qa.storj.io/login does not show this error but https://satellite.qa.storj.io/v2/login does
@andriikotko also mentioned that this error was not present in previous releases

[mobyvb]

Commenting here that this behavior is not consistent. Vitalii was right that in certain situations, this issue is present in both production and QA, on both V1 and V2.

Vitalii tested with Chrome on Mac, and saw this issue in QA V1 and V2, as well as EU1 V1 and V2
Andrii also tested with Chrome on Mac, and saw the issue only in QA V2.
I tested with Brave on Linux and saw the issue only in QA V2
I also tested with Firefox on Linux and saw the issue in QA V1 and V2, as well as US1 V1 and V2

For now, I am going to remove this from our "required tasks to turn on V2 as default", because it does not appear to break the app. We should still fix the issue, but it is not a blocker.

[mobyvb]

more useful screenshots from Andrii:

Firefox QA V2:

Firefox QA V1 and prod:

Safari QA V2:

[VitaliiShpital]

After investigation I realised that this is related to hcaptcha. If hcaptcha is disabled then errors go away. I tried to update dependency and play with types/sizes but it didn't help.

Also, we have different errors. Guys above provided error messages related to style-src directive. Here is my error in prod app (EU1 - Googe Chrome). It's related to script-src directive

[VitaliiShpital]

the other problem is that I don't get those errors in firefox, safari, opera and brave - EU1 sat and both v1 and v2 apps. I get this ^ error only in google chrome.

Also, I think errors depend on type of the challenge. If there is no challenge then there are no errors and vice-versa

[VitaliiShpital]

official hcaptcha docs have this statement which is a bit suspicious

If you are an enterprise customer and would like to enable additional verification to be performed, you can optionally choose the following CSP strategy:

- unsafe-eval and unsafe-inline should include https://hcaptcha.com, https://*.hcaptcha.com

[VitaliiShpital]

ok, I figured out style-src violation issue. It was presented by new app loader styles

CC @wilfred-asomanii

[storj-gerrit]

Change web/satellite/v2: fixed style-src CSP error mentions this issue.