javascript - 尝试从 api 获取 json 数据时的 Cordova 安全策略

Question

jquery-1.11.1.min.js:4 Refused to connect to 
'https://xxxxxxxx/v1/common/introductions/faqs' because it 
violates the following Content Security Policy directive: "default-src 
'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'". Note that 
'connect-src' was not explicitly set, so 'default-src' is used as a 
 fallback.

这是我在为我的 cordova 应用程序执行此 jquery 时遇到的错误

$(document).ready(function(){


        $("#FAQS").html("Hello worldss!");
        alert("rajesh");
        $.getJSON("https://xxxxxxxxx/v1/common/introductions/faqs",
        function(result)
        {
            $("#FAQS").html(result['faq'][0]);
            alert("hi");
        })

   });

这是我的 index.html 中的安全策略

<meta http-equiv="Content-Security-Policy" content="default-src 'self' 
data: gap: https://ssl.gstatic.com 'unsafe-eval'; connect-src 'self' 
https://xxxxxxxx/v1/common/introductions/faqs; style-src 'self' 
'unsafe-inline'; media-src *">

我在堆栈溢出中关注了很多问题 Cordova - Refused to connect to api from device (Content Security Policy)

但无法显示我的 json 数据并且显示相同的错误

Answer 1

查看以下 example from html5rocks :

如果您想将来自 https://apis.google.com/js/plusone.js 的代码列入白名单，您必须像这样将源主机的名称添加到您的 CSP

script-src 'self' https://apis.google.com

因此，要允许访问 https://xxxxxxxx/v1/common/introductions/faqs，您必须将相应的主机名称添加到您的 CSP:

connect-src 'self' https://xxxxxxxx

一个完整的 CSP 可能如下所示:

<meta http-equiv="Content-Security-Policy" content="default-src 'self' 
data: gap: https://ssl.gstatic.com 'unsafe-eval'; connect-src 'self' 
https://xxxxxxxx; style-src 'self' 
'unsafe-inline'; media-src *">

另见 Mozilla's documentation在 connect-src 指令上。它明确说明了主机源的外观:

Internet hosts by name or IP address, as well as an optional URL scheme and/or port number. The site's address may include an optional leading wildcard (the asterisk character, '*'), and you may use a wildcard (again, '*') as the port number, indicating that all legal ports are valid for the source.