CSP Incorrectly blocking allowed sources

[MissCatTrap]

Lychee version

6.10.2

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

Sorry if this is not a lychee issue, but it seems to be as the CSP is partially working, meaning I think its not correctly getting added to the header

Basically I added fonts.googleapis and fonts.gstatic to the style-src and style-src-elem however, the websites are still blocked by the CSP policy, when they should be allowed.

I have tried a few different formats:
The default for style-sr : 'url' => true and 'url'
D7415 recommendation by copying img-src format

no success with either: CSP keeps blocking it

Steps to reproduce the issue

1. Add website (in this case fonts.googleapis) to the style-src in secure-headers.php
2. Receive error in console saying its been blocked by the CSP

Diagnostics [REQUIRED]

Lychee SE Version (release):               6.10.2
DB Version:                                6.10.2
Docker:                                    false
composer install:                          --no-dev
APP_ENV:                                   production
APP_DEBUG:                                 false
APP_URL:                                   set
APP_DIR:                                   set
LOG_VIEWER_ENABLED:                        true
System:                                    Darwin
PHP Version:                               8.3.27
PHP User agent:                            Lychee/6 (https://lycheeorg.dev/)
Timezone:                                  Europe/London
Max uploaded file size:                    500M
Max post size:                             500M
Chunk size:                                12.80 MB
Max execution time:                        200
SQLite Version:                            3.51.0
exec() Available:                          yes
Imagick Available:                         -
Imagick Enabled:                           1
Imagick Version:                           -
GD Version:                                2.3.3
Number of foreign key:                     26 found.

		
Space
Load space usage.
Configuration
version:                                   061002
check_for_updates:                         1
sorting_photos_col:                        taken_at
sorting_photos_order:                      DESC
sorting_albums_col:                        max_taken_at
sorting_albums_order:                      DESC
imagick:                                   1
skip_duplicates:                           0
small_max_width:                           0
small_max_height:                          360
medium_max_width:                          1920
medium_max_height:                         1080
lang:                                      en
image_overlay_type:                        desc
default_license:                           CC-BY-SA-4.0
compression_quality:                       90
grants_full_photo_access:                  1
delete_imported:                           0
mod_frame_enabled:                         0
mod_frame_refresh:                         30
thumb_2x:                                  1
small_2x:                                  1
medium_2x:                                 1
landing_page_enable:                       0
search_public:                             1
hide_version_number:                       0
recent_age:                                1
grants_download:                           0
photos_wraparound:                         1
map_display:                               1
zip64:                                     1
map_display_public:                        1
map_provider:                              OpenStreetMap.org
map_include_subalbums:                     0
update_check_every_days:                   3
has_exiftool:                              0
share_button_visible:                      1
import_via_symlink:                        0
has_ffmpeg:                                1
location_decoding:                         1
location_decoding_timeout:                 30
location_show:                             1
location_show_public:                      0
rss_enable:                                0
rss_recent_days:                           7
rss_max_items:                             100
prefer_available_xmp_metadata:             0
editor_enabled:                            0
lossless_optimization:                     0
local_takestamp_video_formats:             .avi|.mov
log_max_num_line:                          1000
unlock_password_photos_with_url_param:     0
nsfw_visible:                              1
nsfw_blur:                                 1
nsfw_warning:                              1
nsfw_warning_admin:                        0
nsfw_banner_override:                      
map_display_direction:                     1
album_subtitle_type:                       oldstyle
upload_processing_limit:                   4
new_photos_notification:                   0
zip_deflate_level:                         6
default_album_protection:                  3
album_decoration:                          layers
album_decoration_orientation:              row
allow_username_change:                     1
auto_fix_orientation:                      0
random_album_id:                           
use_last_modified_date_when_no_exif_date:  1
layout:                                    justified
date_format_photo_thumb:                   M j, Y, g:i:s A e
date_format_photo_overlay:                 M j, Y, g:i:s A e
date_format_sidebar_uploaded:              M j, Y, g:i:s A e
date_format_sidebar_taken_at:              M j, Y, g:i:s A e
date_format_hero_min_max:                  F Y
date_format_hero_created_at:               M j, Y, g:i:s A T
date_format_album_thumb:                   M Y
upload_chunk_size:                         0
nsfw_banner_blur_backdrop:                 1
search_pagination_limit:                   300
search_minimum_length_required:            3
photo_layout_justified_row_height:         320
photo_layout_masonry_column_width:         300
photo_layout_grid_column_width:            250
photo_layout_square_column_width:          200
photo_layout_gap:                          12
display_thumb_album_overlay:               always
display_thumb_photo_overlay:               hover
default_album_thumb_aspect_ratio:          1/1
use_album_compact_header:                  0
back_button_enabled:                       1
back_button_text:                          Return to Home
SA_random_thumbs:                          1
login_required:                            0
enable_unsorted:                           1
enable_starred:                            1
enable_recent:                             0
enable_on_this_day:                        0
login_required_root_only:                  1
dark_mode_enabled:                         0
low_quality_image_placeholder:             0
show_keybinding_help_popup:                0
show_keybinding_help_button:               1
disable_se_call_for_actions:               1
enable_se_preview:                         0
slideshow_timeout:                         5
keep_original_untouched:                   1
timeline_photos_enabled:                   1
timeline_photos_public:                    1
timeline_photos_granularity:               day
timeline_photos_order:                     taken_at
timeline_photos_layout:                    justified
timeline_photos_pagination_limit:          200
timeline_albums_enabled:                   1
timeline_albums_public:                    1
timeline_albums_granularity:               year
timeline_left_border_enabled:              1
timeline_photo_date_format_year:           Y
timeline_photo_date_format_month:          M Y
timeline_photo_date_format_day:            j M Y
timeline_photo_date_format_hour:           g:i
timeline_album_date_format_year:           Y
timeline_album_date_format_month:          M Y
timeline_album_date_format_day:            j M
hide_nsfw_in_smart_albums:                 1
hide_nsfw_in_frame:                        1
hide_nsfw_in_map:                          1
hide_nsfw_in_search:                       1
search_photos_layout:                      justified
hide_nsfw_in_rss:                          1
hide_nsfw_in_timeline:                     1
number_albums_per_row_mobile:              3
cache_enabled:                             0
cache_ttl:                                 86400
low_number_of_shoots_per_day:              10
medium_number_of_shoots_per_day:           50
high_number_of_shoots_per_day:             100
maintenance_processing_limit:              5000
disable_recursive_permission_check:        1
exif_disabled_for_all:                     0
file_name_hidden:                          0
default_old_settings:                      0
default_expert_settings:                   0
default_all_settings:                      0
client_side_favourite_enabled:             1
disable_thumb_download:                    1
disable_thumb2x_download:                  1
disable_small_download:                    1
disable_small2x_download:                  1
disable_medium_download:                   1
disable_medium2x_download:                 1
temporary_image_link_enabled:              0
temporary_image_link_when_logged_in:       0
temporary_image_link_when_admin:           0
temporary_image_link_life_in_seconds:      86400
secure_image_link_enabled:                 1
SA_override_visibility:                    0
TA_override_visibility:                    0
enable_colour_extractions:                 0
colour_extraction_driver:                  farzai
home_page_default:                         gallery
gallery_header_enabled:                    1
gallery_header_logged_in_enabled:          1
gallery_header:                            https://skyehaynes.me/photos/image/eyJpdiI6Ikc1WkliNjRjNEtyVlFHam9qYmlxdGc9PSIsInZhbHVlIjoiK3lzMzZETkg5RXRnd2NOWHlVR2tvYW5oT0xqRW9VUHRIaENnS1RRYlRIUkFtR2ZidktpcHIwVktlQ285OG5nWiIsIm1hYyI6ImQ1YmFlNzVjY2RlNDc0NGM0YzNhYzg3M2VhM2ZlYTc2MzhiMmQ5Mzc2ZDk0ODVmNzg4MDE2ZWYwM2RhMTM0YmMiLCJ0YWciOiIifQ==
gallery_header_bar_transparent:            1
gallery_header_bar_gradient:               1
import_via_url_forbidden_localhost:        1
import_via_url_forbidden_local_ip:         1
import_via_url_require_https:              1
import_via_url_forbidden_ports:            1
flow_enabled:                              1
flow_public:                               1
flow_base:                                 
flow_max_items:                            10
flow_strategy:                             auto
flow_include_sub_albums:                   1
flow_include_photos_from_children:         0
flow_open_album_on_click:                  0
flow_display_open_album_button:            1
flow_highlight_first_picture:              1
flow_min_max_enabled:                      1
flow_display_statistics:                   1
flow_compact_mode_enabled:                 1
flow_image_header_enabled:                 1
flow_image_header_cover:                   cover
flow_image_header_height:                  24
flow_carousel_enabled:                     1
flow_carousel_height:                      6
date_format_flow_published:                M j, Y, g:i:s A e
date_format_flow_min_max:                  F Y
flow_blur_nsfw_enabled:                    1
hide_nsfw_in_flow:                         1
skip_duplicates_early:                     1
sync_delete_missing_photos:                0
sync_delete_missing_albums:                0
sync_dry_run:                              1
is_scroll_to_navigate_photos_enabled:      1
is_swipe_vertically_to_go_back_enabled:    1
details_links_enabled:                     1
details_links_public:                      0
photo_thumb_tags_enabled:                  1
hide_nsfw_in_tag_albums:                   1
hide_nsfw_in_tag_listing:                  1
sorting_pinned_albums_col:                 created_at
sorting_pinned_albums_order:               DESC
copyright_text:                            
timeline_page_enabled:                     1
timeline_quick_access_date_format_year:    Y
timeline_quick_access_date_format_month:   M
timeline_quick_access_date_format_day:     j M
timeline_quick_access_date_format_hour:    h M, g:i
watermark_enabled:                         0
watermark_photo_id:                        
watermark_public:                          1
watermark_logged_in_users_enabled:         0
renamer_enabled:                           0
renamer_enforced:                          0
renamer_enforced_before:                   0
renamer_enforced_after:                    0
renamer_photo_title_enabled:               1
renamer_album_title_enabled:               1
extract_zip_on_upload:                     1
webshop_currency:                          EUR
webshop_default_description:               No description provided.
webshop_allow_guest_checkout:              1
webshop_terms_url:                         
webshop_privacy_url:                       
webshop_default_price_cents:               0
webshop_default_license:                   personal
webshop_default_size:                      medium
enable_untagged:                           1
photos_pagination_limit:                   500
deduplicate_pinned_albums:                 0
desktop_dock_full_transparency_enabled:    0
mobile_dock_full_transparency_enabled:     0```

### Browser & System [REQUIRED]

MacBook Air 2022 M2
macOS Tahoe 26.0.1
Safari

also tested on

Windows 10 PC

### Please confirm (incomplete submissions will not be addressed)

- [X] I have provided easy and step-by-step instructions to reproduce the bug.
- [X] I understand my bug report will be removed if I haven't met the criteria above.
- [X] I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[d7415]

As I suggested on Discord, did you try copying the format from the other CSP directives?

[MissCatTrap]

Yes to no luck, that’s why I took it here

just didn’t bother taking new screenshots

[d7415]

so

'allow' => ['https://fonts.googleapis.com', 'https://fonts.gstatic.com'],

?

[MissCatTrap]

I tried that and it killed the entire lychee/httpd instance… I will try again as it’s entirely possible I accidentally broke something else in the process

[MissCatTrap]

Well that didn't work again, so I copied and paste what you put...

I realised I was being stupid and missing a comma 💀 (hence the error)

Thank you for your help - I now have learnt a lot more about lychee during this saga

I have also learnt that adding it into style-src-elem breaks everything... I won't question it as it works if its blank