-1

I am trying to send a post request, from the devtools console, containing the HTML of the page, for a linkedin job advert, using the below fetch request. However, the request fails with the errors:

VM339:1 Refused to connect to 'https://mywebsite.com/storage' because it violates the following Content Security Policy directive: "connect-src 'self' wss: blob: static-src.linkedin.com https://www.linkedin.com cdn.lynda.com s2.lynda.com video-uploads-prod.s3.amazonaws.com video-uploads-prod.s3-accelerate.amazonaws.com https://media-src.linkedin.com/media/ https://dpm.demdex.net/id https://lnkd.demdex.net/event *.licdn.com realtime.www.linkedin.com graph.microsoft.com dmsuploads.www.linkedin.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com".

and:

VM287:1 Refused to connect to 'https://mywebsite.com/storage' because it violates the document's Content Security Policy.

Fetch request:

fetch("https://mywebsite.com/storage", {
  method: "post",
  mode: "no-cors",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "example.com",
    html: document.documentElement.innerHTML,
  }),
})
  .then(res => res.text())
  .then(data => console.log(data))
  .catch(err => console.error(err));

How can I avoid these errors and successfully send a post request from the devtools console? This is for a personal project where I am tracking job adverts/applications.

Max888
  • 3,089
  • 24
  • 55

1 Answers1

-1

The Content-Security-Policy header is meant to protect the browser from a compromised website.

Most sites don't use it, but LinkedIn does.

If you're ok with taking the risk during dev, you need to disable content security policy (temporarily!).

root
  • 5,528
  • 1
  • 7
  • 15