{"action":"created","issue":{"url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/46","labels_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/46/comments","events_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/46/events","html_url":"https://github.com/rwjblue/ember-cli-content-security-policy/issues/46","id":95813534,"number":46,"title":"still getting CSP violation report-only warning even if contentSecurityPolicy is overridden","user":{"login":"hotterd","id":1899434,"avatar_url":"https://avatars.githubusercontent.com/u/1899434?v=3","gravatar_id":"","url":"https://api.github.com/users/hotterd","html_url":"https://github.com/hotterd","followers_url":"https://api.github.com/users/hotterd/followers","following_url":"https://api.github.com/users/hotterd/following{/other_user}","gists_url":"https://api.github.com/users/hotterd/gists{/gist_id}","starred_url":"https://api.github.com/users/hotterd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hotterd/subscriptions","organizations_url":"https://api.github.com/users/hotterd/orgs","repos_url":"https://api.github.com/users/hotterd/repos","events_url":"https://api.github.com/users/hotterd/events{/privacy}","received_events_url":"https://api.github.com/users/hotterd/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-18T10:40:51Z","updated_at":"2015-11-16T03:30:44Z","closed_at":"2015-10-25T19:56:16Z","body":"Hi,\r\n\r\nI'm using ember-cli to receive data from REST API backed by express at http://localhost:3000\". \r\nI have my env settings as follows\r\n```javascript\r\n    contentSecurityPolicy: {\r\n      'connect-src' : \"'self' http://localhost:3000\"\r\n    }\r\n```\r\nWhile I can get the data and render it without problem, I'm still seeing a report-only warning as below:\r\n```\r\n[Report Only] Refused to load plugin data from '' because it violates the following Content Security Policy directive: \"default-src 'none'\". Note that 'object-src' was not explicitly set, so 'default-src' is used as a fallback.\r\n```\r\nThis warning keeps bumping up until I override default-src from 'none' to 'self' in addition to the 'connect-src':\r\n```\r\n'default-src': \"'self'\",\r\n...\r\n```\r\nIs this the expected behavior?\r\n\r\nHere's the versions:\r\n```\r\n[Debug] DEBUG: ------------------------------- (vendor.js, line 15931)\r\n[Debug] DEBUG: Ember      : 1.13.3 (vendor.js, line 15931)\r\n[Debug] DEBUG: Ember Data : 1.13.5 (vendor.js, line 15931)\r\n[Debug] DEBUG: jQuery     : 1.11.3 (vendor.js, line 15931)\r\n[Debug] DEBUG: ------------------------------- (vendor.js, line 15931)\r\n```\r\nI'm using safari to test the page, it this matters.\r\n\r\nThanks,\r\nGan\r\n"},"comment":{"url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/comments/156904224","html_url":"https://github.com/rwjblue/ember-cli-content-security-policy/issues/46#issuecomment-156904224","issue_url":"https://api.github.com/repos/rwjblue/ember-cli-content-security-policy/issues/46","id":156904224,"user":{"login":"hotterd","id":1899434,"avatar_url":"https://avatars.githubusercontent.com/u/1899434?v=3","gravatar_id":"","url":"https://api.github.com/users/hotterd","html_url":"https://github.com/hotterd","followers_url":"https://api.github.com/users/hotterd/followers","following_url":"https://api.github.com/users/hotterd/following{/other_user}","gists_url":"https://api.github.com/users/hotterd/gists{/gist_id}","starred_url":"https://api.github.com/users/hotterd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hotterd/subscriptions","organizations_url":"https://api.github.com/users/hotterd/orgs","repos_url":"https://api.github.com/users/hotterd/repos","events_url":"https://api.github.com/users/hotterd/events{/privacy}","received_events_url":"https://api.github.com/users/hotterd/received_events","type":"User","site_admin":false},"created_at":"2015-11-16T03:30:44Z","updated_at":"2015-11-16T03:30:44Z","body":"@sandstrom thanks for the explanation, I'll look into it."}}