hi, i have a question. I'm implementing apple thirdparty signin. the flow works fine and apple call my api/auth/callback/apple with response status 200 but the backend don't return to my website domain. In Chrome console i have this error: "Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘self’“. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-O+xgXnYzZer/Ev6f0GV4Y96/B1k6naW0deebXvwnaXQ=’), or a nonce (‘nonce-...’) is required to enable inline execution." Can u help me?

hey!

no

can you disable all browser extensions and try again?

ok, i'll try

So this usually happens only in development mode based on browser settings

app.use( helmet({ crossOriginResourcePolicy: isProduction, crossOriginEmbedderPolicy: false, contentSecurityPolicy: { directives: { frameAncestors: [ 'https://*.sporteams.app', 'http://localhost*', 'http://*.sporteams.app', ], frameSrc: [ 'https://*.sporteams.app', 'http://localhost*', 'http://*.sporteams.app', ], }, }, frameguard: false, }), );

ahhh right.

could this help?

Can you comment out the helmet middleware and see if that solves the issue?

ok, i'll try

also maybe you can open an issue about this in our node repo github, that would be great

i'm testing if this resolve the error and then i'll open the issue on github 😄

cool. Even if it does resolve it, we should still make it so that it works with helmet

ok 😄