title: iOS Refused to connect because it appears in neither the connect-src directive nor the default-src directive of the Content Security Policy
body: <p>So I made a phonegap app which uses socket.io to do stuff.<br>
  I have the following Content-Security-Policy (CSP)</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="
                                  default-src * data: blob: ws: wss:;
                                  style-src * 'unsafe-inline'; 
                                  script-src * 'unsafe-inline' 'unsafe-eval';
                                  connect-src * ws: wss:;"&gt;
  </code></pre>
  
  <p>When I start the app on safari / iOS I get the following error:</p>
  
  <pre><code>Refused to connect to ws://10.0.1.63:3000/socket.io/?EIO=3&amp;transport=websocket&amp;sid=xTaMJwP3rVy3UnIBAAAi 
  because it appears in neither the connect-src directive nor the default-src directive of the Content Security Policy.
  </code></pre>
  
  <p>AND:</p>
  
  <pre><code>SecurityError (DOM Exception 18): The operation is insecure.
  </code></pre>
  
  <p>The same app with the same CSP works just fine on Chrome / Android but not on Safari / iOS.<br>
  I think this has something to do with:<br>
  <a href="https://webkit.org/blog/6830/a-refined-content-security-policy/" rel="noreferrer">a refined content security policy (WebKit)</a></p>
  
  <p>Resources that seem to come up a lot:  </p>
  
  <ul>
  <li><a href="https://github.com/thelounge/lounge/issues/580" rel="noreferrer">The Lounge fails to work over https due to Content Security Policy
  enforcement in Safari v10</a> </li>
  <li><a href="https://github.com/thelounge/lounge/pull/597" rel="noreferrer">request isn't sent on iOS 10.0</a></li>
  </ul>
  
  <p>Why is it saying "Refused to connect to "URL starting with ws:" because it appears in neither the connect-src directive nor the default-src directive of the Content-Security-Policy even though it is mentioned in both?</p>
  
  <p>Okay, safari / iOS is more strict than chrome / Android when it comes to this, all fine, but it still needs to enable me to allow the connection through. This is really frustrating for an app developer! Solutions?</p>
  
  <p>EDIT:
  Made a bug report on bugs.webkit.org: <a href="https://bugs.webkit.org/show_bug.cgi?id=165754" rel="noreferrer">https://bugs.webkit.org/show_bug.cgi?id=165754</a></p>