CSP error because of WebVR / CloudFront – how to disable that request?

Hi,

we’re integrating a krpano based 360° viewer into a website with a rather strict Content Security Policy.

In the browser console we’re seeing this error:

Refused to frame 'https://d8d913s460fub.cloudfront.net/' because it violates the following Content Security Policy directive:
"frame-src 'self' xxxxx.

From older posts I found that this URL seems to be related to the WebVR plugin and the webvr.loadsettings() call, which tries to load/save WebVR user settings via that CloudFront URL.

In our case:

• Because of CSP we don’t want/are not allowed to allow arbitrary *.cloudfront.net in frame-src.

My questions:

1. Why does the WebVR plugin need to access
   https://d8d913s460fub.cloudfront.net/krpanocloud/webvr_localstorage.html (what exactly is stored there)?
2. What is the recommended way to prevent this request?

   • Is it enough/supported to remove or comment out

     Code

     webvr.loadsettings();

     in plugins/webvr.xml?

   • Or should we disable/remove WebVR completely on our side (e.g. no <include url="plugins/webvr.xml" /> and no <plugin name="webvr" …>)?

I would prefer a “clean” solution that doesn’t require editing core plugin files if possible.

Thanks in advance for any hints and best practices!

Andreas

Hi Klaus,

thanks for your quick reply.

I just checked it – the player itself was already up to date, but in the config there was still a reference to an older WebVR plugin in a different folder. I’ve now replaced it with the current version and the CSP error is gone.

Thanks a lot for your help! 😊

Best regards from Tyrol,
Andy