Asset (CSS) from CDN not working in Play 2.6-RC2

Tareq Nabeel

unread,

Jun 19, 2017, 5:20:29 PM6/19/17

to Play Framework

Thank you for all your work on Play. I'm testing upgrade to Play 2.6.0-RC2.

The following was working in Play 2.5.13 and before.

It stopped working in Play 2.6.0-RC2 i.e. the styles are not detected on the page (even though I could manually download the files from CDN).

When I hosted the files locally, then it worked:

I did delete my caches in Chrome to make sure they're not causing issues.

Any idea what setting might be missing in my local configuration?

Thanks,

Tareq

Justin du coeur

unread,

Jun 19, 2017, 5:24:22 PM6/19/17

to play-fr...@googlegroups.com

Do you have the contentSecurityPolicy set in your application.conf? That's more strictly enforced in Play 2.6, and can cause this sort of problem. If you open Chrome's Inspect window and look at it, I'd expect you to be seeing security errors saying that you're not allowed to load those pages. You have to tell Play in config to allow the third-party domain access...

--
You received this message because you are subscribed to the Google Groups "Play Framework" group.
To unsubscribe from this group and stop receiving emails from it, send an email to play-framework+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/play-framework/ad95fe2f-faa7-41ea-8cc0-064edd2cef43%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Will Sargent

unread,

Jun 19, 2017, 7:14:29 PM6/19/17

to play-fr...@googlegroups.com

I think you want script-src to contain bootstrapcdn.com here:

https://developers.google.com/web/fundamentals/security/csp/

--

Will Sargent

Engineer, Lightbend, Inc.

will.s...@lightbend.com

To view this discussion on the web visit https://groups.google.com/d/msgid/play-framework/CAO26FW2FatW3Y6bPdOpqAdeasszk6AniguH4wtgm%2BHS33ckRMQ%40mail.gmail.com.

Reply all

Reply to author

Forward