Examples not working on safari

[ghost]

I am trying to test the example on Safari ( MacOSx ) but it doesnot work.

I got this error on the console:
[Error] Refused to connect to ws://localhost:7681/ because it does not appear in the connect-src directive of the Content Security Policy.
[Error] SecurityError: The operation is insecure.
(anonymous function) (example.js:34)
new_ws (example.js:34)
(anonymous function) (example.js:39)

Any suggestion?

[lws-team]

The lws examples all promote using a strict Content Security Policy, with the idea that if the examples build it in from the start then users will use it.

The default CSP includes this

content-security-policy:",
"default-src 'none'; img-src 'self' data: ; "
"script-src 'self'; font-src 'self'; "
"style-src 'self'; connect-src 'self'; "
"frame-ancestors 'none'; base-uri 'none';"
"form-action 'self';"

On Firefox and Chrome, connect-src 'self' already included in there is enough to satisfy this. AFAICS that's enough already

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src

You accessed the page in the browser using "http://localhost:7681"?

[lws-team]

Oh it seems it's ambiguous and different only in Safari

w3c/webappsec-csp#7

[lws-team]

I pushed a patch on master lws that might help with it

[ghost]

Perfect. It works to me.
Thank you!

[ghost]

@lws-team,

Now it works but sometimes refreshing the page I got this error now ( only on Safari )

WebSocket connection to 'wss://localhost:7681/' failed: Compressed bit must be 0 if no negotiated deflate-frame extension

Any idea why?

[lws-team]

compressed bit

It seems to be related to your other problem, not the SCP thing.

You seem to be writing garbage on the wire in both this and the other case.

Lws makes writing garbage hard, if you follow the rules about only using lws_write(), only using lws_write() once per WRITEABLE callback, only calling it from WRITEABLE, and not calling any lws api from any other thread than the event loop (except lws_cancel_service(), which is designed for it).