Content Security Policy: webview can't be loaded

[senyai]

Hi!

I installed v3.12.0 and everything seems fine. I can now view images and see Git Graph webview:

Unfortunately, it only works when I set security.csp.enable=false in firefox 92.0's about:counfig.
When security.csp.enable=true I get this error:

Content Security Policy: The page’s settings blocked the loading of a resource at https://10.0.70.102:5777/webview/service-worker.js?id=5172e4da-f9d5-45e8-867e-c0a1b91924a0&swVersion=2&extensionId=vscode.image-preview&platform=browser&vscode-resource-base-authority=vscode-resource.vscode-webview.net&parentOrigin=https%3A%2F%2F10.0.70.102%3A5777 (“img-src”).

I was unable to load webviews in chromium.

I'm running server as

code-server\
 --bind-addr 0.0.0.0:5002\
 --auth none\
 --cert\
 --cert-host 10.0.70.102

There's this SO thread, but I understand nothing. Can this be fixed? Or will it only work with valid certificates?

[jsjoeio]

Thanks for the notes! Yeah, you're going to need a valid certificate in order to get past this AFAIK. I don't think this can be fixed by code-server because then we'd have to remove our CSPs which probably wouldn't be a good idea from a security perspective.

Feel free to close this if that answers the question!

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no activity occurs in the next 5 days.