bug: CSP blocks API calls when accessing frontend from non-localhost #2

New issue

Closed

opened 2026-03-12 02:15:27 +00:00 by Brouie · 11 comments

Brouie commented

2026-03-12 02:15:27 +00:00

(Migrated from gitlab.com)

Content-Security-Policy in index.html only allows http://localhost:* and http://127.0.0.1:*. When accessing the frontend from a remote IP (e.g. VPS), all contract queries are blocked.

connect-src needs to include the host IP or use a wildcard for development.

Quick fix: add http://:* to the connect-src directive in index.html.

Content-Security-Policy in index.html only allows http://localhost:* and http://127.0.0.1:*. When accessing the frontend from a remote IP (e.g. VPS), all contract queries are blocked. connect-src needs to include the host IP or use a wildcard for development. Quick fix: add http://<host-ip>:* to the connect-src directive in index.html.

Brouie commented

2026-03-12 03:25:07 +00:00

(Migrated from gitlab.com)

mentioned in issue #1

PlasticDigits commented

2026-03-12 03:25:09 +00:00

(Migrated from gitlab.com)

For security reasons the quick fix isnt acceptable, instead we should investigate options for dev only environments to whitelist an ip address

Brouie commented

2026-03-13 04:22:44 +00:00

(Migrated from gitlab.com)

mentioned in issue #18

PlasticDigits commented

2026-03-13 07:15:24 +00:00

(Migrated from gitlab.com)

mentioned in commit 42392b8bc7

mentioned in commit 42392b8bc75e1ac6a0d2a9ac0c62677be184c3e2

PlasticDigits commented

2026-03-13 07:15:29 +00:00

(Migrated from gitlab.com)

Fix pushed to main in 42392b8. The cspDevHosts Vite plugin now auto-detects the machine's network interface IPs and injects them into the CSP connect-src directive during vite dev. Production builds are unaffected.

@Brouie — could you verify this resolves the issue on your VPS setup?

Fix pushed to main in 42392b8. The `cspDevHosts` Vite plugin now auto-detects the machine's network interface IPs and injects them into the CSP `connect-src` directive during `vite dev`. Production builds are unaffected. @Brouie — could you verify this resolves the issue on your VPS setup?

Brouie (Migrated from gitlab.com) closed this issue

2026-03-13 12:18:33 +00:00

Brouie commented

2026-03-13 12:18:34 +00:00

(Migrated from gitlab.com)

Verified fixed — CSP auto-detects VPS IP via cspDevHosts Vite plugin. Frontend works without manual CSP patch.

Brouie commented

2026-03-14 03:21:42 +00:00

(Migrated from gitlab.com)

mentioned in commit ecdb4fe1d3

mentioned in commit ecdb4fe1d3b15820304c86932528f942dbf868b5

Brouie commented