Form Captcha extension: Content Security Policy of your site blocks some resources

[vonguyenkhang]

When I enable Form Captcha extension (xExtension-Captcha), using reCAPTCHA v3, on login page I get this error in browser console and unable to login (clicking on login button has no effect):

Framing 'https://www.google.com/' violates the following Content Security Policy directive: "frame-src https://www.google.com/recaptcha/api.js https://www.gstatic.com/recaptcha/". The request has been blocked.

When I edit the file extensions/xExtension-Captcha/extension.php line 192 from

$csp_hosts .= "/recaptcha/api.js https://www.gstatic.com/recaptcha/";

to

$csp_hosts .= "/recaptcha/ https://www.gstatic.com/recaptcha/";

then no more error and I can log in sucessfully.

Have I misconfigured something?

[Inverle]

Have I misconfigured something?

No, looks like it's a bug in the extension since I probably forgot to test reCaptcha after making some changes in 1.0.1

PR welcome with the line changed if you can

[vonguyenkhang]

Sorry, I do not understand much about CSP or reCAPTCHA, and my post above was just "a shot in the dark", so even if create a PR with the changes above, I won't be able to give a meaningful explanation for the changes.

[Inverle]

#435