CSP restrictions broke bull-board UI

[vlada79]

Due to CSP browser restrictions UI is not working any more in Chrome/FF. Please use window.location.pathname instead of passing basePath via window object (this would allow us to skip inlined <script> tag).

[vlada79]

Here is the exact error message I got:

Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' data:". Either the 'unsafe-inline' keyword, a hash ('sha256-JQ8P/kftdTOmqTk22YgMnj13Xuwy9oFjpQGrD1RF8ZE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.

[vcapretz]

Hey, sorry for the delay! great catch 😄

I'll take a look into this, the suggested fix would indeed make the code a bit simpler

[gabrielstuff]

Hello @vlada79 we run bull-board without issues. Could you tell us the context where you met this issue ?

Thanks

[kevinlangleyjr]

I ran into the same issue when using helmet with my app and bull-board is just one of the routes that the middleware is applied to.