Closed Bug 1355468 Opened 9 years ago Closed 9 years ago

Content Security Policy warnings opening BMO homepage

Categories

(bugzilla.mozilla.org :: User Interface, defect)

Product:
bugzilla.mozilla.org
Component:
User Interface
Version:
Production
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: emorley, Unassigned)

Details

In Firefox Nightly, opening https://bugzilla.mozilla.org/ results in a number of CSP warnings in the console: When logged out: Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://bugzilla.mozilla.org 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: onsubmit attribute on DIV element. Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://bugzilla.mozilla.org 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: onchange attribute on DIV element. Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://bugzilla.mozilla.org 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: onfocusin attribute on DIV element. When logged in the error message doesn't mention the nonce: Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://bugzilla.mozilla.org"). Source: onsubmit attribute on DIV element.
(In reply to Ed Morley [:emorley] from comment #0) > In Firefox Nightly, opening https://bugzilla.mozilla.org/ results in a > number of CSP warnings in the console: > > When logged out: > > Content Security Policy: The page's settings blocked the loading of a > resource at self ("script-src https://bugzilla.mozilla.org > 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: onsubmit > attribute on DIV element. > Content Security Policy: The page's settings blocked the loading of a > resource at self ("script-src https://bugzilla.mozilla.org > 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: onchange > attribute on DIV element. > Content Security Policy: The page's settings blocked the loading of a > resource at self ("script-src https://bugzilla.mozilla.org > 'nonce-MyuNENOTypWrjRs8IFexw8G3gp9ujVqtBEldS4WzEBV5fTHc'"). Source: > onfocusin attribute on DIV element. I can't repro that -- what happens if you shift-reload?
Flags: needinfo?(emorley)
Hmm, also compare to https://bugzilla.mozilla.org/index.cgi, I believe this is a result of the DDoS mitigation.
Oh this appears to be due to LastPass, which even when logged out interferes with the page. Sigh.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(emorley)
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.