Latest version is not recording CSP policies at all

[injcristianrojas]

"Record this site" functionality is not working. It stays in default-src 'none' after enabling it.
Extension version: 3.0.7
Browser version: 73.0.1 (64-bit) Linux

[april]

Can you give me any other information? I just tested it with 3.0.7, and it seems to be recording fine for me.

[injcristianrojas]

I'm trying to do a CSP over localhost:4200 (I'm using it on an Angular SPA). Does it blacklist capturing localhost traffic?

[april]

Hmm, I guess I dunno. I've never tested it with localhost; it's possible that Firefox doesn't let me snoop on other localhost.

Does it record for other, non-localhost sites?

[injcristianrojas]

Yes it does. Some localhost restriction by Firefox, perhaps?

[jarvars]

I confirm the issue in firefox 87.0 with extension 3.0.8, for sites deployed on localhost, for other sites is ok.

[april]

Do you see any errors in the console when you're recording?

[Ricky-Tigg]

OS: Linux 5.11.15-300.fc34.x86_64; Firefox version: 88.0 for Fedora; Enterprise Policies: Inactive; Extension version, release date: 3.0.8, April 29, 2021; Site applied to: https://www.csc.fi/

Issue confirmed.

[Ascl3pi0s]

I am experiencing a similar issue whenever the port is specified in the url, the "Record this site" options doesn't work.

e.g. https://somesiteurl:8443 it will not record, but https://othersiteurl everything works correctly.

I'm not sure if this is relevant info, but it is the only pattern that replicate the issue on my end.

I'm using:

Laboratory version 3.0.8
Firefox 92.0.1
Windows 10

[sbernard31]

@april, I have exactly same issue, No way to record when using localhost.
It's a problem because testing locally is definitely needed to be able fix some CSP problem.

I'm using firefox 128.5.0esr (64 bits)

Any alternative or workaround is welcome. 🙏

[april]

It wouldn’t surprise me if this is a security restriction for web extensions.

Can you try localhost. as the hostname? Or add an entry to your hosts file that maps to 127.0.0.1 and use that hostname?

[sbernard31]

Thx for taking time to answer 🙏

Tested with :

• localhost:8080
• 127.0.0.1:8080
• 127.0.1.1:8080
• [::]:8080
• localhost.:8080
• domain1:8080 (where domain1 is map to 127.0.0.1)
• domain2:8080 (where domain2 is map to 127.0.1.1)

For each of them, when I launch "Record" OR when I set "custom policy" with laboratory nothing happens.

Note that if I add a <meta http-equiv="Content-Security-Policy" ... > in an HTML meta balise, Firefox is able to raise CSP violation in the console even for localhost.