I am not really sure but since I enabled the refreshTokens on auth0-spa-js, my CSP is blocking an inline-script, a worker for a blob: and a script with a hash sha256-CjbsvJcxUx3M+4F2KcGh0DoVaOk/TU125pa7AZxyM90= on route /callback. I am suspecting it to be related to an iframe that may be required …

If you use CSP with refreshTokens, I can confirm that enabling refreshTokens in auth0-spa-js requires blob: on worker-src and on child-src (as Safari doesn’t support worker-src)

CSP blocks RefreshToken related script, blob and worker?

Get Help

system Closed June 24, 2020, 12:05pm 4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Prevent SPA JS SDK from doing iframe-based silent authentication Knowledge Articles sdk , spa , js , refresh_token , access , offline , fallback , silent-authentication	1	2424	September 21, 2022
Using Auth0 js sdk in Browser Worker Get Help	0	1748	March 7, 2022
New auth0 spa js Get Help	4	3166	October 4, 2019
Token refresh does not work in `auth0-spa-js` Product Feedback sdk , javascript	3	3610	July 19, 2022
CSP Inline Style Blocked in Auth0 React Widget after Setting INLINE_RUNTIME_CHUNK=false Get Help security-question-concern , security-compliance	3	19	June 2, 2025

CSP blocks RefreshToken related script, blob and worker?

Related topics