[Bug] Documentation Website Not Loading

[tonyawad88]

Version

latest

Link to Minimal Reproduction

https://echarts.apache.org/en/api.html

Steps to Reproduce

Currently the website at https://echarts.apache.org/en/api.html isn't loading and throwing errors in both Firefox and Chrome. Errors below:

Refused to load the stylesheet 'https://fastly.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
api.html:12 Refused to load the stylesheet 'https://fastly.jsdelivr.net/npm/[email protected]/lib/theme-chalk/index.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
$ is not defined
Uncaught TypeError: Cannot read properties of undefined (reading 'directive')
echartsDoc is not defined

Current Behavior

As mentioned above

Expected Behavior

Page loads properly

Environment

- OS:MacOS
- Browser: Firefox and Chrome
- Framework: N/A

Any additional comments?

No response

[Lerrissirrel]

It's more than just this one page; I ran into this on the main page and examples page too. Thought I was going crazy. FWIW the latest versions of those pages on the wayback machine (From Jan 28) work.

[SpyridonLaz]

Me and my colleagues face the same issue since today morning. +1

[malikmmoaz]

[justy152]

Yep it's unusable. Seems like the website is hosted on github? Was looking to see if I could fix it myself but didn't get very far

[plainheart]

We are sorry about this. The ECharts website has to take some time to adapt to the new Content Security Policy of Apache server before March 1st.

[malikmmoaz]

https://www.devdoc.net/web/echarts-site-20190821/en/api.html#echarts

temp fix

[mizushino]

This is due to the Content Security Policy.
You can view the content by using the Chrome extension "Disable Content Security Policy."
However, please use this extension with caution.

[Avaray]

This is due to the Content Security Policy. You can view the content by using the Chrome extension "Disable Content Security Policy." However, please use this extension with caution.

Wow, it works.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

[justy152]

Using that kind of extension is not something we can do at work. How long do we expect the website to be down for?

…

On Mon, 3 Feb 2025, 07:10 Avaray, ***@***.***> wrote: This is due to the Content Security Policy. You can view the content by using the Chrome extension "Disable Content Security Policy." However, please use this extension with caution. Wow, it works. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP — Reply to this email directly, view it on GitHub <#20728 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFC5NB2GGIS5XSBMLOJFLXL2N4I4TAVCNFSM6AAAAABWJQBINGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMZQGEZTOOBYGE> . You are receiving this because you commented.Message ID: ***@***.***>

[helgasoft]

seems resolved now. But the examples inside still do not show, some error "echarts.apache.org refused to connect"

[Avaray]

seems resolved now

Nice

[Ovilia]

We are extremely sorry for the unpleasant experience caused by the unavailability of the website. This was due to the update of the Content Security Policy by the Apache Software Foundation. We have adopted a temporary solution to ensure the accessibility of the website. If you still encounter any problems, please give us your feedback. We are currently communicating with ASF, hoping to further address the issue of access speed while ensuring network security.

[helgasoft]

Many official examples are still not showing, like
https://echarts.apache.org/examples/en/editor.html?c=bar-race-country
https://echarts.apache.org/examples/en/editor.html?c=bar-histogram
https://echarts.apache.org/examples/en/editor.html?c=heatmap-bmap
https://echarts.apache.org/examples/en/editor.html?c=animating-contour-on-globe&gl=1

Currently any file not coming from domain apache.org is refused.
Before, there were several other domains allowed, like baidu.com, jsdelivr.net, etc.
So the security issue is not resolved quite yet.

[2548085610]

https://www.devdoc.net/web/echarts-site-20190821/en/api.html#echarts

temp fix

非常感谢/Thank you

[bonatoc]

All demos using GL are broken, due to a 404 error on:

https://echarts.apache.org/en/js/vendors/echarts-gl@2/dist/echarts-gl.min.js

An example: https://echarts.apache.org/examples/en/editor.html?c=image-surface-sushuang&gl=1

[helgasoft]

The dropdown for ECharts version selection has disappeared from the Editor.
Hope this is not permanent.