1

My application requires external URL of GoogleMap API to be executed in a packaged App. When I execute the code on simulator, I get the following error in Security Tab

"Content Security Policy: The page's settings blocked the loading of a resource at https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=true&callback=initialize ("script-src app://58b444ed-2bd9-4ce2-8687-09694b09d6ae")."

Kindly provide a solution to handle this

Regards Rashmi

frasertweedale
  • 5,424
  • 3
  • 26
  • 38
Rashmi Laroia
  • 31
  • 3
  • I think you have to use WebActivity API: https://developer.mozilla.org/en-US/docs/Web/API/Web_Activities – Noitidart Jul 06 '15 at 15:02
  • Actually I think you need to use systemXHR: https://developer.mozilla.org/en-US/Apps/Build/App_permissions direct link: https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest#mozSystem so set `mozSystem` attribute – Noitidart Jul 06 '15 at 15:07

1 Answers1

0

There are few reasons why you might get a CPS error. Please refer to this url for more information. https://developer.mozilla.org/en-US/Apps/Build/Building_apps_for_Firefox_OS/CSP

By default, CSP is enforced only on privileged and certified apps. If you have a simple packaged app, you shouldn't have CSP issues. If you didn't mention anything for the app type, you shouldn't have issues.

The CSP for privileges app are:

"default-src *; 
 script-src 'self'; 
 object-src 'none'; 
 style-src 'self' 'unsafe-inline'"

And for certified:

"default-src *; 
 script-src 'self'; 
 object-src 'none'; 
 style-src 'self'"

Which mean that you cannot have a script that points on a remote server other than your own. If your packaged app is loading an external url, you could probably proxy the google js trough your server. As the script-src will match the default-src, it should work.

Otherwise, you could probably save the script directly in your project. This is probably not recommended but that could also work.

There is also chances that the script provided by google won't work anyway if they use eval and new Function.

Loïc Faure-Lacroix
  • 13,220
  • 6
  • 67
  • 99