# Content Security Policy is making me loose my hair

**URL:** <https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134>\
**Category:** Extensions\
**Created:** [August 11, 2019, 9:11pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134 "2019-08-11T21:11:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thial](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/thial/32/8033_2.png) [@Thial](https://staging-discuss.dev.twitch.com/u/Thial)\
**Post date:** [August 11, 2019, 9:11pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134/1 "2019-08-11T21:11:26Z")

</div>

Hello so I have a web server on heroku and I’m trying to talk to the EBS from an uploaded extension but despite including the required Content-Security-Policy properties I keep getting an error upon sending a GET request:

`Refused to connect to 'http://stalker-twitch-integration.herokuapp.com/U30463352/0/0/11001/1' because it violates the following Content Security Policy directive: "connect-src https: wss:".`

When I’m doing the same by just opening the extension from my personal PC the request gets sent succesfully.

Any ideas what could be causing it ? This is my current meta tag:

`<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' http://* 'unsafe-inline' 'unsafe-eval'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval';" />`

I have tried adding the `connect-src https: wss:` too but then it doesn’t even work locally.

---

<div class="post-metadata">

**Author:** ![Dist](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://staging-discuss.dev.twitch.com/u/Dist)\
**Post date:** [August 11, 2019, 9:18pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134/2 "2019-08-11T21:18:53Z")

</div>

All communication between an Extension and EBS has to be secure, hence the requirement for https or wss.

You are getting a CSP error because your EBS URL isn’t using HTTPS.

---

<div class="post-metadata">

**Author:** ![Thial](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/thial/32/8033_2.png) [@Thial](https://staging-discuss.dev.twitch.com/u/Thial)\
**Post date:** [August 11, 2019, 9:25pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134/3 "2019-08-11T21:25:27Z")

</div>

Hey Dist, how would I go about using HTTPS with Heroku ? I thought it was required to use http with heroku ?

Currently my server is done this way:

```
const PORT = process.env.PORT || 3000;

const _httpServer = http.createServer(_credentials,_app);

_httpServer.listen(PORT, () => {
	console.log('Server is now running on port '+PORT);
});
```

---

<div class="post-metadata">

**Author:** ![3ventic](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/3ventic/32/298_2.png) [@3ventic](https://staging-discuss.dev.twitch.com/u/3ventic)\
**Post date:** [August 11, 2019, 9:26pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134/4 "2019-08-11T21:26:58Z")

</div>

You can just switch the http to https in your URL. You’ll notice if you try it directly in your browser, it says OK instead of giving an error.

---

<div class="post-metadata">

**Author:** ![Thial](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/thial/32/8033_2.png) [@Thial](https://staging-discuss.dev.twitch.com/u/Thial)\
**Post date:** [August 11, 2019, 9:30pm UTC](https://staging-discuss.dev.twitch.com/t/content-security-policy-is-making-me-loose-my-hair/22134/5 "2019-08-11T21:30:18Z")

</div>

Bro… Have a like