-
Notifications
You must be signed in to change notification settings - Fork 114
Description
If I access the URL https://ceph.io/en/community/meetups/ with my fully updated Google Chrome regular session, similar to #297, the calendar iframe displays the error This content is blocked. Contact the site owner to fix the issue.
If I open this URL inside Incognito session the calendar iframe content renders correctly.
Based on some web searches this might be a known problem relating to Google Chrome being logged in with a Google account.
Some findings from my debugging:
- The iframe content does a 302 redirect to
https://accounts.google.com/:
- The content is then blocked due to CSP:
- The dev console displays the following error:
Refused to frame 'https://accounts.google.com/' because it violates the following Content Security Policy directive: "default-src 'self' https://ceph.matomo.cloud/ https://fonts.gstatic.com/ https://www.youtube.com/ https://calendar.google.com/". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
The error is consistent with the 302 redirect and I suspect this could be fixed by simply adding the redirect host to the CSP.
I did not spend a lot of time looking at this so it's possible I'm totally off course but the above seems feasible to me.
I believe I had disabled for this site all browser extensions but could have made a mistake.