csp is disabled but working
Categories
(Firefox :: Untriaged, defect)
Tracking
()
People
(Reporter: 2386343100, Unassigned)
Details
Attachments
(1 file)
239.22 KB,
image/png
|
Details |
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:99.0) Gecko/20100101 Firefox/99.0
Steps to reproduce:
update firefox from v97 to v99.
my js script is not working, it's a xhr requests. about:
var xhr = new XMLHttpRequest();
var url = "http://example..."
xhr.open('GET', url, false);
xhr.onload = function () {
// 请求结束后,在此处写处理代码
};
xhr.send(null);
var response = xhr.response
return JSON.parse(response)
Actual results:
error:
#Uncaught DOMException: A network error occurred.
#Content Security Policy: 页面设置阻止读取位于 http://..的一项资源("connect-src")。
Expected results:
In firefox v97 about:config, I change the "security.csp.enable" from ture to false. The script is working. But in firefox v99, The script run error either the "security.csp.enable" is true or false.
Comment 1•2 years ago
|
||
security.csp.enable was removed. bug 1754301 contains some tips for removing the header using an extension.
Description
•