How to load css style in firefox and solve Content Security Policy:problem?

0
votes

I have this Wicket page:

<html>
<head>
<title>Cheesr - Making cheese taste beta</title>
<wicket:link>
    <link href="style.css" rel="stylesheet" />
</wicket:link>
</head>
<body>
<div id="container">
<div id="header">
<h1>...</h1>
</div>
<div id="contents">
<div id="main">
<div wicket:id="cheeses" class="cheese">
<h3 wicket:id="name">Gouda</h3>
<p wicket:id="description">Gouda is a Dutch...</p>
<p><span wicket:id="price">$1.99</span> <a wicket:id="add" href="#">add
to cart</a></p>
</div>
<div wicket:id="navigator"></div>
<wicket:remove>
    <div class="cheese">
    <h3>Emmental</h3>
    <p>Emmental is a Swiss che...</p>
    <p><span>$2.99</span> <a href="#">add to cart</a></p>
    </div>
</wicket:remove></div>
<div id="cart">
<h3>Your selection</h3>
<table>
    <tbody>
        <tr wicket:id="cart">
            <td wicket:id="name">Gouda</td>
            <td wicket:id="price">2.99</td>
            <td><a wicket:id="remove" href="#">remove</a></td>
        </tr>
        <wicket:remove>
            <tr>
                <td>Emmental</td>
                <td>$1.99</td>
                <td><a href="#">remove</a></td>
            </tr>
        </wicket:remove>
    </tbody>
    <tfoot>
        <tr class="total">
            <th>Total</th>
            <td wicket:id="total">$1.99</td>
            <td>&nbsp;</td>
        </tr>
    </tfoot>
</table>
<input type="button" wicket:id="checkout" value="Check out" /></div>
</div>
</div>
</body>
</html>

When I try to access page in firefox, Css styles does not work. In developers tools console I have Content Security Policy: The page's settings blocked the loading of a resource at http://localhost:8080/cheesestore/wicket/resource/org.heller.wicket.Index/style-ver-1614525831181.css ("style-src"). Can someone give me a point how to solve this issue?

2
csswicketcontent-security-policy

2 Answers

1
votes

Wicket 9 has enabled CSP protection by default. If you want to disabled it just use this code in your app init():

@Override
protected void init() {
  super.init();
  getCspSettings().blocking().disabled();
  // ...
}
1
votes

To configure CSP you should do something like:

 myApplication.getCspSettings().blocking().clear()
   .add(CSPDirective.DEFAULT_SRC, CSPDirectiveSrcValue.NONE)
   .add(CSPDirective.STYLE_SRC, CSPDirectiveSrcValue.SELF)
   .add(CSPDirective.SCRIPT_SRC, CSPDirectiveSrcValue.SELF)
   .add(CSPDirective.IMG_SRC, CSPDirectiveSrcValue.SELF)
   .add(CSPDirective.FONT_SRC, CSPDirectiveSrcValue.SELF);

The important line for your case is: .add(CSPDirective.STYLE_SRC, CSPDirectiveSrcValue.SELF)