SSL、自定义顶级域名、Crossdomain.xml和Adsense。它们能和谐共处吗？

Question

我正在开发一个使用广告联盟的新网站，它是 https://viewing.nyc，但仍在不断改进中。目前已经在该网站上显示了一些广告，这些广告正常工作，也就是实际上展示了广告，但是它们会在 Safari 控制台输出大量无用信息。

我经常看到的消息是经典的：

Blocked a frame with origin "https://googleads.g.doubleclick.net" from accessing a frame with origin "https://viewing.nyc". Protocols, domains, and ports must match.

所以，我一直在琢磨这个问题，偶尔搜索解决方案，试图理解如何解决它。我使用以下代码实现了一个crossdomain.xml文件：

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/crossdomain-policy.dtd">
<cross-domain-policy>
  <allow-access-from domain="*.youtube.com" secure="false"/>

  <allow-access-from domain="*.doubleclick.net" secure="false"/>
  <allow-access-from domain="*.2mdn.net" secure="false"/>
  <allow-access-from domain="*.dartmotif.net" secure="false"/>

  <allow-access-from domain="*.doubleclick.net" secure="true"/>

  <allow-access-from domain="*.doubleclick.com" secure="true"/>
  <allow-access-from domain="*.doubleclick.com" secure="false"/>
  <allow-access-from domain="*.2mdn.net" secure="true"/>
  <allow-access-from domain="*.dartmotif.net" secure="true"/>
  <allow-access-from domain="*.gstatic.com" secure="false"/>
</cross-domain-policy>

但是没有成功。这个问题是由于我使用了.nyc顶级域名，而广告联盟的网站使用了.com吗？是否有一种方法可以规避这些错误？

- coneybeare

Answer 1

您的网站输出了以下标头。

X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block
X-Request-Id: 86d0d6f2-eba5-46b2-b6cf-9ce77fc1f16e
X-Download-Options: noopen
X-Runtime: 0.955425
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src 'self'; connect-src 'self' viewing.nyc *.viewing.nyc cdn.jsdelivr.net csi.gstatic.com pagead2.googlesyndication.com; font-src 'self' viewing.nyc *.viewing.nyc *.viewingnyc.dev fonts.gstatic.com data:; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https:; img-src 'self' viewing.nyc *.viewing.nyc *.viewingnyc.dev s3.amazonaws.com pagead2.googlesyndication.com *.amazon-adsystem.com *.ssl-images-amazon.com *.media-amazon.com *.assoc-amazon.com *.twimg.com *.twitter.com *.instagram.com *.facebook.com data:; manifest-src 'self'; media-src utoob.com; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' viewing.nyc *.viewing.nyc *.viewingnyc.dev *.googletagservices.com *.googleadservices.com *.googlesyndication.com adservice.google.com googleads.g.doubleclick.net *.amazon-adsystem.com *.twimg.com *.twitter.com *.instagram.com *.facebook.com *.facebook.net gleam.io js.gleam.io lightwidget.com *.lightwidget.com; style-src 'self' 'unsafe-inline' viewing.nyc *.viewing.nyc *.viewingnyc.dev *.twitter.com *.instagram.com *.facebook.com fonts.googleapis.com gleam.io *.gleam.io; upgrade-insecure-requests

我建议您删除Content-Security-Policy头和X-Permitted-Cross-Domain-Policies头。如果您想让AdSense正常工作，还应该删除crossdomain.xml。

这不是一个理想的解决方案，但Google没有给出Content-Security-Policy允许的域名列表，它每天都在变化，所以现在最好避免使用这些头部。

- Niresh