What went wrong?
The "Define" button in the epub reader selection popup always shows "Could not load definition." The client-side dictionary lookup calls api.dictionaryapi.dev and wiktionary.org, but the server's Content Security Policy blocks these requests.
Steps to reproduce
- Open any book in the epub reader
- Select a word (e.g., "ostentation")
- Tap the Define button
Expected vs actual behavior
Expected behavior:
A dictionary definition appears in the popover.
Actual behavior:
"Could not load definition" error with a Retry button. Browser console shows:
Fetch API cannot load https://en.wiktionary.org/api/rest_v1/page/definition/ostentation.
Refused to connect because it violates the document's Content Security Policy.
Root cause:
In server/src/common/utils/bootstrap.utils.ts, the connect-src directive is:
const connectSrc = ["'self'", 'ws:', 'wss:', 'https://cdn.jsdelivr.net', ...]
Missing: https://api.dictionaryapi.dev and https://*.wiktionary.org which are needed by useDictionary.ts.
Your setup
- BookOrbit version/image tag: latest
- Deployment: Docker / Unraid
- OS: Unraid
- Browser: Edge (latest)
Relevant logs (optional)
Screenshots (optional)
No response
Before submitting
What went wrong?
The "Define" button in the epub reader selection popup always shows "Could not load definition." The client-side dictionary lookup calls api.dictionaryapi.dev and wiktionary.org, but the server's Content Security Policy blocks these requests.
Steps to reproduce
Expected vs actual behavior
Expected behavior:
A dictionary definition appears in the popover.
Actual behavior:
"Could not load definition" error with a Retry button. Browser console shows:
Fetch API cannot load https://en.wiktionary.org/api/rest_v1/page/definition/ostentation.
Refused to connect because it violates the document's Content Security Policy.
Root cause:
In server/src/common/utils/bootstrap.utils.ts, the connect-src directive is:
const connectSrc = ["'self'", 'ws:', 'wss:', 'https://cdn.jsdelivr.net', ...]
Missing: https://api.dictionaryapi.dev and https://*.wiktionary.org which are needed by useDictionary.ts.
Your setup
Relevant logs (optional)
Screenshots (optional)
No response
Before submitting