I can't use livereload anymore, because I get
Refused to load the script 'http://www.company.de:35729/livereload.js' because it violates the following Content Security Policy directive ... Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback."
Im not sure why I get this error even though the script is hosted on my own server.
I tried to allow it like this in my
app\code\Company\Csp\etc\csp_whitelist.xml
<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
<policies>
<policy id="script-src">
<values>
<value id="livereload" type="host">www.company.de*</value>
...
But it does not work this way.
Notes:
<?php
namespace Company\Csp\Plugin; // <-- in my real script, Company is replaced by my vendor name
use Magento\Csp\Model\Collector\CspWhitelistXmlCollector;
use Magento\Csp\Model\Policy\FetchPolicy;
class Csp
{
/**
* @inheritDoc
*/
public function afterCollect(CspWhitelistXmlCollector $cspWhitelistXmlCollector, $defaultPolicies = []): array
{
$ip = dns_get_record($_SERVER['HTTP_HOST'],DNS_A)[0]['ip'];
$port = "35729";
$hostUrl = $ip . ':' . $port;
$defaultPolicies[] = new FetchPolicy(
"connect-src",
false,
[$hostUrl, "ws://" . $hostUrl],
[],
false,
false,
false,
[],
[],
false,
false
);
$defaultPolicies[] = new FetchPolicy(
"script-src",
false,
[$hostUrl],
[],
false,
false,
false,
[],
[],
false,
false
);
return $defaultPolicies;
}
}