Content Security Policy (CSP) support for Simple Light Box

[ricky176]

Does simplelightbox support CSP?

If not is there any plan for CSP support in future.

[Mtillmann]

Hi, what exactly do you mean? CSP is implemented on the document level of by passing http headers. Simplelightbox is a clientside lib

[ricky176]

After implementing CSP during user interaction on image lightbox is adding some inline style to the DOM element which is blocked by CSP.

Please. let me know if I am able to explain you properly.

[Mtillmann]

Thanks for Info! Are you loading simplelightbox from a cdn host? It's not clear from the screenshots?

[ricky176]

Thanks for Info! Are you loading simplelightbox from a cdn host? It's not clear from the screenshots?

Yes its loaded from cdn host.

[Mtillmann]

Please look into how to set up CSP rules to allow scripts from the CDN host you're using. This is not an issue directly related to simplelightbox I believe.

[ricky176]

Please look into how to set up CSP rules to allow scripts from the CDN host you're using. This is not an issue directly related to simplelightbox I believe.

You can check in the above screen shot the cdn from where light box is loaded is whitelisted in earlier screenshot of chrome console.

The issue is with lightbox trying to add some style when user interacts which is blocked by csp.

The lightbox js n css both are loaded and available during page load as the cdn is whitelisted.