This is a bug in the configuration. See https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

There is nothing to do at the plugin level.

The resolution of this bug is that as a workaround we open by default the non-framed page.

well, I'm using the non-framed page workaround too

But, it's still a pity not to have the framed javadoc working.

I'm pleased so far with

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP",
 "default-src 'none'; img-src 'self'; style-src 'self'; child-src 'self'; frame-src 'self'; script-src 'unsafe-inline';")

but tried to clear the hudson...CSP system property (see 1st comment by Christian) ... but this does not help, (framed) javadoc not loading.

It does not work when there is just one package, because the attempted fix looked only for overview-summary.html, which is generated only when there are multiple packages. A refined fix could look for index-all.html, or overview-tree.html, or allclasses-noframe.html, or some */package-summary.html.

One workaround: use the more general Publish HTML plugin, for example:

publishHTML([reportDir: 'target/site/apidocs/', reportName: 'Javadoc', reportTitles: 'Javadoc', reportFiles: 'allclasses-noframe.html'])

To make this a bit more interesting, javadoc generated by Java 11 (likely Java9+) changes the behavior even further[1]:

• No frames by default (can be turned on but the feature is expected to go away).
• Dependency on javascript execution.
  • Redirect from index.html to single package-summary.html in case of single package project.
  • Framed navigation is replaced by JS-based search.
• It even appears, the <noscript> does not kick in when javascript is disables through CSP.

I went on exploring Jesse's suggestion of using different landing page on Javadoc 8 and 11 as well as using single/multi package projects. Both index-all.html and overview-tree.html appears to work (though subjectively, I am not sure this is the first page I would like to see) but allclasses-noframe.html is not generated on Java 11 (by default, at least).

[1] https://bugs.openjdk.java.net/browse/JDK-8202961

It even seems javadoc 11 redirects from overview-summary.html to index.html for multipackage projects while it redirects from index.html to the only package-summary.html available in case of singlepackage project. IOW, none of the locations is safe to use.

The **/package-summary.html can not be used as an index page either as it does not reside in the project root (obviously, it is summary of a java package) and therefore it refers to resources as ../../../foo.bar which obviously fails. In theory, this can be overcome by not using it as an index page for DirectoryBrowserSupport but modifying the JavadocAction too redirect to it instead so it is rendered at expected path.

I gave up decided to keep things simple and used overview-tree.html that is not ideal but prone of all those issues: https://github.com/jenkinsci/javadoc-plugin/pull/10

https://github.com/jenkinsci/javadoc-plugin/pull/10 needs to be released to close it

I have released 1.5 today which should integrate the recent reports

Wrong status in that case.