Click here to Skip to main content
15,879,613 members
Home / Discussions / Web Development
   

Web Development

 
PinnedHow to get an answer to your question Pin
Chris Maunder4-Sep-10 2:25
cofounderChris Maunder4-Sep-10 2:25 
PinnedHOW TO ANSWER A QUESTION PinPopular
Chris Maunder12-Jul-09 22:40
cofounderChris Maunder12-Jul-09 22:40 
QuestionWhat is generally the current best method for storing uploaded documents? Pin
we5inelgr6-Mar-24 15:06
we5inelgr6-Mar-24 15:06 
AnswerRe: What is generally the current best method for storing uploaded documents? Pin
Bohdan Stupak7-Mar-24 5:45
professionalBohdan Stupak7-Mar-24 5:45 
GeneralRe: What is generally the current best method for storing uploaded documents? Pin
we5inelgr7-Mar-24 9:05
we5inelgr7-Mar-24 9:05 
GeneralRe: What is generally the current best method for storing uploaded documents? Pin
jschell8-Mar-24 11:40
jschell8-Mar-24 11:40 
AnswerRe: What is generally the current best method for storing uploaded documents? Pin
jschell8-Mar-24 11:47
jschell8-Mar-24 11:47 
AnswerRe: What is generally the current best method for storing uploaded documents? Pin
Andre Oosthuizen9-Mar-24 0:47
mveAndre Oosthuizen9-Mar-24 0:47 
QuestionLooking for a working working sample google maps on blazor web app with loading markers from database Pin
urx194124-Jan-24 23:19
urx194124-Jan-24 23:19 
AnswerRe: Looking for a working working sample google maps on blazor web app with loading markers from database Pin
jschell25-Jan-24 4:36
jschell25-Jan-24 4:36 
GeneralRe: Looking for a working working sample google maps on blazor web app with loading markers from database Pin
michael floeter25-Jan-24 21:29
michael floeter25-Jan-24 21:29 
GeneralRe: Looking for a working working sample google maps on blazor web app with loading markers from database Pin
jschell30-Jan-24 4:51
jschell30-Jan-24 4:51 
QuestionSetting a CORS header, and allowing my Javascript modules that are inlined Pin
jkirkerx24-Jan-24 10:30
professionaljkirkerx24-Jan-24 10:30 
I'm at the end of the project finally, and I'm putting the wraps on it.

I started programming headers in PHP for cache, and then it expanded into security as well. I built a system of ECMAScript modules, and my entry point module is being blocked by my CORS header. I can't figure this out, and could use some guidance on the subject.

Here is what I have.
/assets/scripts/core
/assets/scripts/core/coreExternal.module.js

coreExternal.module.js content
window.coreExternal {
  setCommissionStartDate,
  setCommissionStopDate, and so forth
On the WebPage, I use a script tag to load coreExternal
<script type="module" src="/pcad/assets/scripts/core/coreExternal.module.js"></script>
This call to the module, makes the window.coreExternal functions look like dangerous inlined script.

This is my PHP header for CORS
$nonce = base64_encode(random_bytes(16));
header("Content-Security-Policy: default-src 'self' *.fontawesome.com; script-src 'self' 'unsafe-inline' /pcad/assets/scripts/core/ https://kit.fontawesome.com/ 'nonce-".$nonce."' 'sha256-...'; style-src 'self'; img-src 'self' data:;");

From reading the documentation from Content Security Policy, I added 'unsafe-inline' which should sledge hammer out my modules, but they are still blocked.

Error Message:
Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Source: coreExternal.setCommissionStartDate(this… assignCommission.phtml

My Questions
I don't do CORS stuff everyday, just once every few years, and this is the first time I've done it in code, and not used the web server to program this. Perhaps I have the concept going but failed in execution, well I'm sure that's it.
  1. Do I need the access-control headers?
  2. Did I paint myself into a corner using modules the way I did?
  3. Is one policy canceling another policy?
I still have issues with these error messages as well
Quote:
Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).
Source: --bs-breadcrumb-divider: '>'; viewVendors.phtml

The manual style I added to the table element
Quote:
Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).
Source: width: 100%; border: none; viewVendors.phtml


These are my headers in PHP. At this point, YES I am throwing darts at the wall on this, plus SMH and Confused | :confused:
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0");
header("Pragma: no-cache");
header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
header("X-Content-Type-Options: nosniff");
header("X-Frame-Options: DENY");
header("X-XSS-Protection: 1; mode=block");
header('Referrer-Policy: same-origin');

header("Access-Control-Allow-Origin: self");   // Replace * with the actual origin(s) you want to allow
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type");
header("Access-Control-Expose-Headers: *");

// Best Version that works - 01/24/2024 jKirkerx - Warning: Content-Security-Policy: The page’s settings blocked the loading of a resource at https://kit.fontawesome.com/ea5e36f877.js ("script-src").
header("Content-Security-Policy: default-src 'self' *.fontawesome.com; script-src 'self' 'unsafe-inline' /pcad/assets/scripts/core/ https://kit.fontawesome.com/ 'nonce-".$nonce."' 'sha256-...'; style-src 'self'; img-src 'self' data:;");
If it ain't broke don't fix it
Discover my world at jkirkerx.com

AnswerCleaned up my dart board, and got the modules error cleared at least, this will take time, not easy Pin
jkirkerx24-Jan-24 11:26
professionaljkirkerx24-Jan-24 11:26 
GeneralRe: The problem is somewhere else Pin
jkirkerx24-Jan-24 13:06
professionaljkirkerx24-Jan-24 13:06 
AnswerRe: Solved, that was a can of worms to sort out Pin
jkirkerx25-Jan-24 12:13
professionaljkirkerx25-Jan-24 12:13 
QuestionJS Arrow functions this & setTimeout scope Pin
Member 1618344416-Jan-24 1:46
Member 1618344416-Jan-24 1:46 
AnswerRe: JS Arrow functions this & setTimeout scope Pin
Jeremy Falcon25-Jan-24 4:31
professionalJeremy Falcon25-Jan-24 4:31 
QuestionWordPress for Windows Pin
Richard Andrew x647-Jan-24 4:24
professionalRichard Andrew x647-Jan-24 4:24 
AnswerRe: WordPress for Windows Pin
jschell8-Jan-24 5:52
jschell8-Jan-24 5:52 
GeneralRe: WordPress for Windows Pin
Richard Andrew x648-Jan-24 13:49
professionalRichard Andrew x648-Jan-24 13:49 
Questionhow PHP works Pin
mike741126-Dec-23 10:24
mike741126-Dec-23 10:24 
AnswerRe: how PHP works Pin
Richard MacCutchan26-Dec-23 21:47
mveRichard MacCutchan26-Dec-23 21:47 
GeneralRe: how PHP works Pin
trønderen27-Dec-23 8:09
trønderen27-Dec-23 8:09 
GeneralRe: how PHP works Pin
Richard MacCutchan27-Dec-23 21:19
mveRichard MacCutchan27-Dec-23 21:19 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.