violates the following Content Security Policy

[Dexus]

https://devtools.crabnebula.dev/dash/127.0.0.1/3000

3000:24 [Report Only] Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-tmyT8l7IP7C2YHHc6VKGg50G7jh2NdLlebAlHvBcFIE='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

3000:25 [Report Only] Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-8d+n1SkiHFLR7a1xuIcCmVrCzT0JZpc/+9awUfjEb/k='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

__vite-plugin-wasm-helper:31 [Report Only] Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Unchecked runtime.lastError: The message port closed before a response was received.
Unchecked runtime.lastError: The message port closed before a response was received.
Unchecked runtime.lastError: The message port closed before a response was received.
Unchecked runtime.lastError: The message port closed before a response was received.
Unchecked runtime.lastError: The message port closed before a response was received.
Unchecked runtime.lastError: The message port closed before a response was received.
load-fathom.ts:7 [Report Only] Refused to load the script 'https://fine-active.crabnebula.dev/script.js' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

health.client.ts:45 [Report Only] Refused to connect to 'http://127.0.0.1:3000/grpc.health.v1.Health/Check' because it violates the following Content Security Policy directive: "connect-src 'self' 127.0.0.1 ws://localhost:5173/".

health.client.ts:45 [Report Only] Refused to connect to 'http://127.0.0.1:3000/grpc.health.v1.Health/Check' because it violates the following Content Security Policy directive: "connect-src 'self' 127.0.0.1 ws://localhost:5173/".

3000:1 [Report Only] Refused to load the image 'https://fine-active.crabnebula.dev/?h=https%3A%2F%2Fdevtools.crabnebula.dev&p=%2Fdash%2F127.0.0.1%2F3000&r=&sid=HWZIUFBW&qs=%7B%7D&cid=40825323' because it violates the following Content Security Policy directive: "img-src 'self'".

3000:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received
3000:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received
3000:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received
3000:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received
3000:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received

I'm on windows and use the latest chrome. also the latest public released version for tauri.

[Dexus]

Windows Edge works, but chrome looks broken somehow.

[denjell-crabnebula]

Thanks for the heads-up. Requesting @alex-crabnebula to take a look.

[alex-crabnebula]

Edge does not seem to communicate CSP errors in the dev tools. Maybe they'll do so in a future update.

About styles: @tanstack/solid-virtual (which is being used for all virtual lists) and kobalte's popover component (used for tooltips) require the use of dynamic inline-styles that will be very difficult if not impossible to work around. Even though I'm reluctant to reduce our security, I see no other solution than to allow unsafe inline styles at the moment.