1

I am using Firefox 56 because it is the last version that still allows me to use my add-ons.

Today Twitter has changed something in their coding, so that the videos posted on Twitter stopped playing in the browser. While trying to play a video I get a message: The media could not be played In the Web Console I see an error message, like: Content Security Policy: The page’s settings blocked the loading of a resource at blob:https://twitter.com/5970af6d-d6ea-43e1-9bd6-c9d33f08d0a6 (“default-src https://twitter.com”)

If I completely disable the browser's Content Security Policy, by setting "security.csp.enable" to "false", then the videos play normally, as they used to be. Also the videos play normally in Firefox 65 without any tweaks.

I do not want to completely disable the Content Security Policy in my browser as this would pose a security risk.

Is there any way to add an exception to the Content Security Policy in Firefox 56?

=======================================================

Update:

Twitter sends the following response header:

content-security-policy: connect-src 'self' blob: https://*.giphy.com https://*.pscp.tv https://*.video.pscp.tv https://*.twimg.com https://api.twitter.com https://caps.twitter.com https://media.riffsy.com https://pay.twitter.com https://sentry.io https://ton.twitter.com https://twitter.com https://upload.twitter.com https://www.google-analytics.com https://vmap.snappytv.com https://vmapstage.snappytv.com https://vmaprel.snappytv.com https://vmap.grabyo.com https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://smdhdsnappytv-vh.akamaihd.net https://smpdhdsnappytv-vh.akamaihd.net https://smmdhdsnappytv-vh.akamaihd.net https://rmdhdsnappytv-vh.akamaihd.net https://rmpdhdsnappytv-vh.akamaihd.net https://rmmdhdsnappytv-vh.akamaihd.net https://dwo3ckksxlb0v.cloudfront.net ; default-src 'self'; form-action 'self' https://twitter.com https://*.twitter.com; font-src 'self' https://*.twimg.com; frame-src 'self' https://twitter.com https://mobile.twitter.com https://pay.twitter.com https://cards-frame.twitter.com ; img-src 'self' blob: data: https://*.cdn.twitter.com https://ton.twitter.com https://*.twimg.com https://www.google-analytics.com https://www.periscope.tv https://www.pscp.tv https://media.riffsy.com https://*.giphy.com https://*.pscp.tv; manifest-src 'self'; media-src 'self' blob: https://twitter.com https://*.twimg.com https://*.vine.co https://*.pscp.tv https://*.video.pscp.tv https://*.giphy.com https://media.riffsy.com https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://smdhdsnappytv-vh.akamaihd.net https://smpdhdsnappytv-vh.akamaihd.net https://smmdhdsnappytv-vh.akamaihd.net https://rmdhdsnappytv-vh.akamaihd.net https://rmpdhdsnappytv-vh.akamaihd.net https://rmmdhdsnappytv-vh.akamaihd.net https://dwo3ckksxlb0v.cloudfront.net; object-src 'none'; script-src 'self' 'unsafe-inline' https://*.twimg.com   https://www.google-analytics.com https://twitter.com  'nonce-NWNhMmQ5ZjQtYTgwZS00YjVjLTkyODgtNDEzMDMwYWIyOWU2'; style-src 'self' 'unsafe-inline' https://*.twimg.com; worker-src 'self' blob:; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false

Is there any way to remove (filter out) the blob entries from it when a page is loading?

  • Not the answer you're looking for, but there have been a lot of critical security updates (as well as changes to how CSPs are handled) between FF 56 and 70, so I'd advise getting those add-ons rewritten or find alternatives so you can update. – BoffinBrain Oct 27 '19 at 1:39
0

You can try using a browser extension to override the CSP header for that website: https://bewisse.com/modheader/

Add a URL Pattern filter for twitter's website and a Response Header of 'content-security-policy' with some lax policy, such as "default-src *", and see if that works. It sounds like your browser isn't handling policies properly so I'm not 100% sure how it will handle this.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.