Geoserver having issues with apisix

I have hosted geoserver instance behind apisix, with proxy url configured as https:///geoserver.
I can login as admin, beowse through pages, make workspaces, stores , layers etc. But for some action I face issue. Like for , Style → Add a new style → Add legend, I see following errors on chrome dev console:

`jquery-3.7.1-ver-26F…D381E7C0CC0.js:7937
POST …/geoserver/web/wicket/bookmarkable/org.geoserver.w…styleForm-context-panel-legendPanel-externalGraphicContainer-showhide-show 400 (Bad Request)

jquery-3.7.1-ver-26F…D381E7C0CC0.js:6825 Applying inline style violates the following Content Security Policy directive ‘style-src ‘nonce-EcnlFq-R8EiqB62r8ATHk8W8’’. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-ICa0DhwZQJsOd/Rn0N8H6FdQ71GfNL+op2zhAQ+Y4mM=’), or a nonce (‘nonce-…’) is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the ‘unsafe-hashes’ keyword is present. The action has been blocked.
jquery-3.7.1-ver-26F…D381E7C0CC0.js:6825 Applying inline style violates the following Content Security Policy directive ‘style-src ‘nonce-EcnlFq-R8EiqB62r8ATHk8W8’’. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-ZD0chCyBaNHl+4UwQHJIHGoYhKwMeyCXGgJTKW5/67E=’), or a nonce (‘nonce-…’) is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the ‘unsafe-hashes’ keyword is present. The action has been blocked.`

Is it apisix side issue or I need to change configurations in geoserver?

Hi @mghildiy

Check out Content Security Policy - GeoServer Documentation. The first thing I would try is to check Report violations without enforcement, to see if that is the problem, and then to configure CSP correctly.

Peter

1 Like