0 Response to '/oauth/token' Endpoint in SPA Using Canonical Domain

This article addresses the situation in which Auth0 is blocking logging in with the following error:

Refused to frame 'https://*****.auth0.com/' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

• 0 response when calling /oauth/token with canonical domain
• The response headers for their SPA include: Content-Security-Policy default-src 'self'

• Single Page Applications (SPA)
• Canonical Domain

• default-src 'self': - this directive will force “everything” (all fetch directives) - to be loaded via the current domain only. 

• the default-src 'self' policy is getting violated because the root domain on the application does not match the canonical tenant domain (the application is trying to fetch data from a different domain).

1. Add a custom domain.
2. If the custom domain solution does not work, perhaps the Content Security Policy for the SPA can be changed from default-src 'self' to default-src https: (for example) to another value.