Skip to content

[Bug] fix(reader): Dictionary lookup blocked by CSP connect-src directive #403

Description

@GeraldCox

What went wrong?

The "Define" button in the epub reader selection popup always shows "Could not load definition." The client-side dictionary lookup calls api.dictionaryapi.dev and wiktionary.org, but the server's Content Security Policy blocks these requests.

Steps to reproduce

  1. Open any book in the epub reader
  2. Select a word (e.g., "ostentation")
  3. Tap the Define button

Expected vs actual behavior

Expected behavior:
A dictionary definition appears in the popover.

Actual behavior:
"Could not load definition" error with a Retry button. Browser console shows:

Fetch API cannot load https://en.wiktionary.org/api/rest_v1/page/definition/ostentation.
Refused to connect because it violates the document's Content Security Policy.
Root cause:
In server/src/common/utils/bootstrap.utils.ts, the connect-src directive is:

const connectSrc = ["'self'", 'ws:', 'wss:', 'https://cdn.jsdelivr.net', ...]
Missing: https://api.dictionaryapi.dev and https://*.wiktionary.org which are needed by useDictionary.ts.

Your setup

  • BookOrbit version/image tag: latest
  • Deployment: Docker / Unraid
  • OS: Unraid
  • Browser: Edge (latest)

Relevant logs (optional)

Screenshots (optional)

No response

Before submitting

  • I've searched existing issues and this hasn't been reported yet.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingreleasedIssue or PR is included in a released version.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions