Content-Security-Policy header

[Een]

Dear game developers,

Since today's release at 10:15 Paris time, the CSP (Content-Security-Policy) header is now active (instead of just Report-Only).
This should not affect your games if you have been careful to package all resources used in your game modules (so if everything is hosted by BGA servers).

We have also run this header in Report-Only for several weeks to track potential issues, and authorized external resources when we could correlate them to a legitimate use in a game (fonts for example).

Still, we may have missed some, and in general it's better not to rely on external resources since they can (and thus, will) fail someday.
So if you run into any issue where a resource needed for your game is blocked by the CSP header, please:
1) notify us for adding a temporary exception for this resource
2) package the resource inside of your module (after making sure its license allows it) and redeploy

NB: you can check the CSP header using the "Developer tools" of your browser and looking at the response headers

[pjt33]

What about per-user custom CSS? I thought that was a great feature, but this change has broken mine (and the main reason it's in an external resource is that it has become too long for what's currently supported directly).

[lordalx]

Hi. The CSP is currently preventing to integrate the leaderboard for Next Station London on the publisher website.

Code: Select all

Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à https://nextstationlondon.blueorangegames.eu/?player=<player_id>&header=false&date=<YYYY-MM-DD> (« frame-src »).

Could you please add this external resource as an exception :

https://nextstationlondon.blueorangegames.eu/

Thanks in advance

[Een]

What about per-user custom CSS? I thought that was a great feature, but this change has broken mine (and the main reason it's in an external resource is that it has become too long for what's currently supported directly).

Sorry about that. Unfortunately since CSP is exactly about that (block loading of non-whitelisted resources in order to prevent malicious resources from being injected in the page) loading an external CSS from the custom CSS will indeed be blocked. So it means that custom CSS is limited to what's directly supported by BGA.

[Een]

Hi. The CSP is currently preventing to integrate the leaderboard for Next Station London on the publisher website.

Code: Select all

Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à https://nextstationlondon.blueorangegames.eu/?player=<player_id>&header=false&date=<YYYY-MM-DD> (« frame-src »).

Could you please add this external resource as an exception :

https://nextstationlondon.blueorangegames.eu/

Thanks in advance

This resource had been whitelisted but unfortunately with a mistake in the domain name. Fixed now, thanks!

[pjt33]

What about per-user custom CSS? I thought that was a great feature, but this change has broken mine (and the main reason it's in an external resource is that it has become too long for what's currently supported directly).

Sorry about that. Unfortunately since CSP is exactly about that (block loading of non-whitelisted resources in order to prevent malicious resources from being injected in the page) loading an external CSS from the custom CSS will indeed be blocked. So it means that custom CSS is limited to what's directly supported by BGA.

I'm not sure I quite understand the reasoning there. CSP is about preventing malicious user content from user A affecting user B. Would it be possible to add a custom CSP whitelist on the same advanced preferences page as the custom CSS?

[Een]

I'm not sure I quite understand the reasoning there. CSP is about preventing malicious user content from user A affecting user B. Would it be possible to add a custom CSP whitelist on the same advanced preferences page as the custom CSS?

The reasoning is just that this security measure is about preventing (at a technical level) what you describe. So it's logical that it does exactly that.

Now you are right that creating an additional feature to prevent the security measure to apply in the context of the user desiring it (your case here) would be technically possible. But:
- we were not aware of it being used this way;
- it goes beyond the intent of the original feature "you may place some CSS declarations";
- that custom CSS feature itself is probably not something that we would do today as it's in some respects problematic;
- creating a workaround to a security feature is usually not a good idea since it's easy to make a mistake and create a bigger hole than intended;
- this use is marginal (as far as I know today, just you).
So in the current state of things, I can just express that I'm sorry that we broke something you were using, but I cannot commit to providing a solution for this specific usecase.

CSP enforcement occurs in your browser, though, so you may find a solution with some browser level override extension (a quick search seems to indicate this type of extension does exist https://addons.mozilla.org/en-US/firefo ... sp-tester/ but I have not tried them).