[v4]Content Security Policy issue of plugin-upload in strapi-4.0.0-beta.13

[boeto]

Bug report

Describe the bug

[v4]Content Security Policy issue of plugin-upload in strapi-4.0.0-beta.13

Steps to reproduce the behavior

1. Install and change the upload provider to aws-s3

2. Upload an image and get the issue

Expected behavior

Should be able to see the picture. The same setting runs correctly in v3.

Screenshots

Code snippets

// ./config/plugins.js

module.exports = ({ env }) => ({
  upload: {
    config: {
      provider: "aws-s3",
      providerOptions: {
        accessKeyId: env("AWS_ACCESS_KEY_ID"),
        secretAccessKey: env("AWS_ACCESS_SECRET"),
        region: env("AWS_REGION"),
        params: {
          Bucket: env("AWS_BUCKET"),
        },
      },
    },
  },
});

System

• Node.js version: v14.17.6
• YARN version: 1.22.17
• Strapi version: 4.0.0-beta.13
• Database: PostgreSQL 13
• Operating system: macOS 10.15

Additional context

null

[grzegorzbialy]

@boeto The internal middleware config change is not documented but I found out you can change default CSP settings middleware in config/middlewares.js like this:

module.exports = ({ env }) => [
  'strapi::errors',
  {
    name: 'strapi::security',
    config: {
      contentSecurityPolicy: {
        directives: {
          'script-src': ["'self'", "'unsafe-inline'", 'cdn.jsdelivr.net'],
          'img-src': ["'self'", 'data:', 'cdn.jsdelivr.net', 'strapi.io', `${env('AWS_BUCKET')}.s3.${env('AWS_REGION')}.amazonaws.com`],
        },
      }
    },
  },
  'strapi::cors',
  'strapi::poweredBy',
  'strapi::logger',
  'strapi::query',
  'strapi::body',
  'strapi::favicon',
  'strapi::public',
];

[derrickmehaffy]

Provider examples will have an example config to show how to properly modify this. Closing as it's not a bug

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/strapi-v4-broken-image-even-when-the-images-link-works-cloudinary/14143/4

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/strapi-v4-override-csp/14157/2