I use Box through my workplace at the University of Chicago. Until very recently, I was able to connect to the Box portal at https://uchicago.account.box.com/login then log in with SSO. This is using Pale Moon web browser. Starting this week, I was instead redirected to a blank page that is titled Submit Form.
Accessing the web console gives the following error:
GET
https://sso.services.box.net/sp/startSSO.ping
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“default-src”). Source:
window.onload = function() {
....
Disabling Content Security allows for the SSO to go through. Box works fine afterward, including if content security policy is re-enabled.
The same University SSO works fine for other websites.