Skip to content

Instantly share code, notes, and snippets.

@icoloma

icoloma/maps-csp-test.js

Last active December 31, 2015 04:29
Show Gist options
  • Save icoloma/7934269 to your computer and use it in GitHub Desktop.
Save icoloma/7934269 to your computer and use it in GitHub Desktop.
Download ZIP
Test for using Google Maps with Content-Security-Policy
Raw
maps-csp-test.js
var http = require('http')
// To use: execute "node maps-csp-test.js" and open a browser at localhost:8000
// remember to restart the server after making any changes
var server = http.createServer( function(request, response) {
response.writeHead(200, {
'Content-Type': 'text/html; charset=UTF-8'
// This makes Google Maps work
, 'Content-Security-Policy': "script-src 'self' 'unsafe-inline' https://*.googleapis.com https://maps.gstatic.com 'unsafe-eval'"
// This makes Google Maps fail
//, 'Content-Security-Policy': "script-src 'self' 'unsafe-inline' https://*.googleapis.com https://maps.gstatic.com "
});
response.write(
'<!doctype>' +
'<body>' +
'<p>Enter the name of a city' +
'<form><input id="autocomplete" type="text"></form>' +
'<script src="https://maps.googleapis.com/maps/api/js?sensor=false&libraries=places"></script>' +
'<script>new google.maps.places.Autocomplete(document.getElementById("autocomplete"));</script>' +
'</body>'
);
});
// fire it up
console.log('Listening on port 8000');
server.listen(8000);
@icoloma
Copy link
Author

icoloma commented Jan 29, 2014

For the record, changing the last two scripts to these makes no difference:

        '<script>window.googleCallback = function() { new google.maps.places.Autocomplete(document.getElementById("autocomplete")); }</script>' +
        '<script src="https://maps.googleapis.com/maps/api/js?sensor=false&libraries=places&callback=googleCallback"></script>' +

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment