Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Unrecognized Content-Security-Policy directive 'require-trusted-types-for'

See original GitHub issue

Describe the bug The directive 'require-trusted-types-for' is legit, but it says unrecognized CSP directive.

To Reproduce Steps to reproduce the behavior:

Go to web.dev
Test https://aashutosh.dev
In report click on best practices.
It shows this error.

Expected behavior I think no browser error should log (due to 'require-trusted-types-for') while web.dev is visiting the site for report generation.

Screenshots

PS: Please correct me if I misinterpreted something completely.

Issue Analytics

State:
Created 3 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

1reaction

paulirishcommented, May 4, 2020

The article indicates they’re supported in Chrome 83. Stable is still 81. It’s very possible chrome stable emits this browser error into the console. (Not ideal, but that’s how it goes sometimes… forward compat is hard.)

This isn’t a Lighthouse error, though. We’re just reporting that Chrome’s console has errors in it.

1reaction

connorjclarkcommented, May 4, 2020

If the console logged it, this is coming from Chromium. I suggest making an issue on crbug.com if this doesn’t align with your expectations.

looks like it’s an experimental feature in chrome. https://caniuse.com/#feat=mdn-http_headers_csp_content-security-policy_trusted-types and we don’t enable experiments in the env. that powers web.dev

Top Results From Across the Web

CSP: require-trusted-types-for - HTTP - MDN Web Docs

The HTTP Content-Security-Policy (CSP) require-trusted-types-for directive instructs user agents to control the data passed to DOM XSS sink ...

Unrecognized Content-Security-Policy directive 'require ...

The directive 'require-trusted-types-for' is legit, but it says unrecognized CSP directive. To Reproduce Steps to reproduce the behavior: Go to ...

Unrecognized Content-Security-Policy directive - Stack Overflow

Got a similar error on Chrome v 48.0.2564.116 m "Unrecognized Content-Security-Policy directive 'frame-ancestors'.

Unrecognized Content-Security-Policy directive how to fix ...

If the Unrecognized Content-Security-Policy directive error is caused by the deprecated directive, this directive must be removed from the Content Security ...

QWebEngine: Unrecognized Content-Security-Policy directive ...

the WebEngine logs a Unrecognized Content-Security-Policy directive 'require-trusted-types-for' error message and the web site rejects the login. This can be ...