Refused to load 'URL' because it violates the following Content Security Policy (CSP) directive

Products

• Web Isolation

Issue/Introduction

When browsing to an isolated site, the browser may reject the attempt to load Isolation resources because of a cached CSP.  There will be no attempts to load the site in a PCAP or activity logs. 

The Network tab of the browser Developer Tools will indicate failure rather than 200 or 403. 

The console tab will show 'Refused to load 'URL' because it violates the following Content Security Policy (CSP) directive' - and then state the allowed sites that the web site is allowed to reach out to.

Cause

The CSP or Content Security Policy header tells the browser what sites it is allowed to reach out to as a valid part of that page. Requests to other sites from that page can be considered as not valid.  In the case of Isolation, it may instruct the browser to reach out to a shared Isolation resource not specified in the CSP for authentication or other purposes.  If the Isolation server delivered this page, it would have rewritten this CSP to instruct the browser that this is a valid resource for that page.

In some cases, the browser has been to the site recently outside of Isolation and cached the original CSP without the shared Isolation resources.  When the browser is instructed to reach out to Isolation from the main page while using this cached header, it does not accept this and refuses to connect.

Resolution

Use incognito mode

Clear the browser cache, restart the browser, then reload the page.