{"action":"closed","issue":{"url":"https://api.github.com/repos/NWebsec/NWebsec/issues/63","labels_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/63/comments","events_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/63/events","html_url":"https://github.com/NWebsec/NWebsec/issues/63","id":94253471,"number":63,"title":"Owin connect-src not working as expected","user":{"login":"matteo-mosca","id":11195767,"avatar_url":"https://avatars.githubusercontent.com/u/11195767?v=3","gravatar_id":"","url":"https://api.github.com/users/matteo-mosca","html_url":"https://github.com/matteo-mosca","followers_url":"https://api.github.com/users/matteo-mosca/followers","following_url":"https://api.github.com/users/matteo-mosca/following{/other_user}","gists_url":"https://api.github.com/users/matteo-mosca/gists{/gist_id}","starred_url":"https://api.github.com/users/matteo-mosca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matteo-mosca/subscriptions","organizations_url":"https://api.github.com/users/matteo-mosca/orgs","repos_url":"https://api.github.com/users/matteo-mosca/repos","events_url":"https://api.github.com/users/matteo-mosca/events{/privacy}","received_events_url":"https://api.github.com/users/matteo-mosca/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"klings","id":938299,"avatar_url":"https://avatars.githubusercontent.com/u/938299?v=3","gravatar_id":"","url":"https://api.github.com/users/klings","html_url":"https://github.com/klings","followers_url":"https://api.github.com/users/klings/followers","following_url":"https://api.github.com/users/klings/following{/other_user}","gists_url":"https://api.github.com/users/klings/gists{/gist_id}","starred_url":"https://api.github.com/users/klings/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/klings/subscriptions","organizations_url":"https://api.github.com/users/klings/orgs","repos_url":"https://api.github.com/users/klings/repos","events_url":"https://api.github.com/users/klings/events{/privacy}","received_events_url":"https://api.github.com/users/klings/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2015-07-10T08:49:22Z","updated_at":"2015-11-03T22:52:35Z","closed_at":"2015-11-03T22:52:34Z","body":"I am using the owin middleware like this:\r\n\r\n    app.UseCsp(config =>\r\n            {\r\n                config\r\n                    .DefaultSources(c => c.None())\r\n                    .ConnectSources(c => c.Self())\r\n                    .FontSources(c => c.Self())\r\n                    .ImageSources(c => c.Self())\r\n                    .ScriptSources(c => c.Self())\r\n                    .StyleSources(c => c.Self());\r\n            });\r\n\r\nStill, websocket connections from self are refused:\r\n\r\n    Refused to connect to 'ws://localhost:41698/signalr/connect?transport=webSockets&clientProtocol=1.5&connectionToken=OPTrgor3M3NOmxP%2B4WF0jpKPRmKaS2zHtIXxSnWHv7EIXGmmBcv8jC1eq1yKUrege55GHJU6uQARKaEbzvFIl%2BmxEC3Oc68qlEei6EEIbkwBcTXVPFPF%2Fng83pv%2F66Wp&connectionData=%5B%7B%22name%22%3A%22systemhub%22%7D%5D&tid=6' because it violates the following Content Security Policy directive: \"connect-src 'self'\".\r\n\r\nI have found no way to configure with CustomSources() to tell him to allow \"ws://\" + Self.\r\n\r\nThanks."}}