meta tag in cordova app conflicting with Evothings Workbench

[jvosk]

Not sure if anyone else has observed this behavior, and perhaps it's just my setup, but this has been bothering me for the last two days and I only just finally figured it out fifteen minutes ago.

I have developed a prototype application in Evothings, but need to save data to the device. AFAIK, Evothings does not natively support this. (If I am wrong, please someone, let me know!) Thus, I am rewriting/porting to the cordova framework (which Evothings is built on). Frustratingly, when attempting to use Evothings Workbench to automatically update the app, as per these directions -- Cordova Guide -- whether I used

Code: Select all

<content src="http://192.168.x.xx:4042" />

in the config.xml file, or placed a link to

Code: Select all

http://192.168.x.xx:4042

directly in the index.html file, or copied the www folder from the cordova project to an Evothings project and opened the index.html file in the Evothings Client, the Client would stay connected while it loaded initially, but in ~8 seconds or so it would disconnect. After hours of [strike]head-banging-related-activities[/strike] debugging, I traced it back to this meta tag automatically inserted into the cordova-generated index.html file:

Code: Select all

<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *">

After commenting out this meta tag, neither the cordova app nor the Evothings client disconnect after loading the app for the first time. Hopefully this helps someone else!

[Fredrik]

That guide was written for Cordova 3.6, but we're since upgraded to Cordova 5. We'll have to update the guide. We might also change the workbench to strip out any such tags from html files before sending them to the client.

Thanks a lot for your support!

[micke]

Yes thanks a lot for reporting!

For people finding this thread, it is when you create a new Cordova project (with Cordova 5) you get this meta tag in index.html in the generated example project.

The meta tag is there to prevent cross-site scripting, here is further info:

https://w3c.github.io/webappsec/specs/c ... ty-policy/

http://www.html5rocks.com/en/tutorials/ ... ty-policy/

Will update the documentation with instructions to remove the meta tag when using Evothings Workbench.

Best, Mikael