Skip to content

Community calendar content blocked in some cases #927

@bluikko

Description

@bluikko

If I access the URL https://ceph.io/en/community/meetups/ with my fully updated Google Chrome regular session, similar to #297, the calendar iframe displays the error This content is blocked. Contact the site owner to fix the issue.
If I open this URL inside Incognito session the calendar iframe content renders correctly.

Based on some web searches this might be a known problem relating to Google Chrome being logged in with a Google account.

Some findings from my debugging:

  • The iframe content does a 302 redirect to https://accounts.google.com/:
Image
  • The content is then blocked due to CSP:
Image
  • The dev console displays the following error:

Refused to frame 'https://accounts.google.com/' because it violates the following Content Security Policy directive: "default-src 'self' https://ceph.matomo.cloud/ https://fonts.gstatic.com/ https://www.youtube.com/ https://calendar.google.com/". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

The error is consistent with the 302 redirect and I suspect this could be fixed by simply adding the redirect host to the CSP.

I did not spend a lot of time looking at this so it's possible I'm totally off course but the above seems feasible to me.
I believe I had disabled for this site all browser extensions but could have made a mistake.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions