Safari only: Refused to connect to ... because it does not appear in the connect-src directive of the Content Security Policy

user_303914 0
Viewed 2856

When using Google Analytics, I'm getting the following error from Safari 13.1 but not from Chrome:

Refused to connect to https://www.google-analytics.com/j/collect?XYZ
because it does not appear in the connect-src directive of the Content Security Policy.

My application doesn't try to connect to www.google-analytics.com, but it downloads a script from www.googletagmanager.com which in turn downloads a script from www.google-analytics.com.

My CSP are configured as follows:

  • script-src 'self' 'unsafe-eval' data: www.google-analytics.com www.googletagmanager.com www.google.com www.gstatic.com
  • connect-src 'self'

So as Safari says, I don't have google-analytics in connect-src, but that doesn't seem to be a problem for Chrome.

Is my CSP wrong (and Chrome is being too permissive) or is this a bug in Safari?

content-security-policy google-analytics safari google-chrome
1 Answers

Safari is right. Chrome is being too permissive:

The HTTP Content-Security-Policy (CSP) script-src directive specifies valid sources for JavaScript.

Note that this statement is not qualified.

Chrome also violates other postulates of CSP. For example, blocked-uri for different origins requires that the URI path is stripped, but Chrome doesn't do that and Safari does.

At this point in time Safari seems to be more compliant/strict than Chrome, but in any case you should go by the stricter browser because, well, you don't really have a choice...

user_106789550
Related