CSP prevents cross‐origin image preloading #263
Labels
No labels
approved, awaiting change
bug
configuration
documentation
duplicate
enhancement
extremely low priority
feature request
Fix it yourself
help wanted
invalid
mastodon_api
needs docs
needs tests
not a bug
planned
pleroma_api
privacy
question
static_fe
triage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: AkkomaGang/akkoma#263
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Image preloading in Pleroma-FE relies on
fetch()
, but theContent-Security-Policy
header generated by Akkoma does not include the media sources inconnect-src
.As a result, image preload requests will be blocked if the image is not loaded from the same origin.
I noticed this when trying out image preloading with a media proxy cache running on a sub‐domain (Akkoma 3.3.1, Pleroma-FE rev
c8c8d40827
).https://docs.akkoma.dev/stable/configuration/cheatsheet/#media_proxy
you may want to set base_url on the media proxy
I did exactly that, but as far as I can tell from https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/plugs/http_security_plug.ex#L107, it is only included in
img-src
andmedia-src
but not inconnect-src
.should be fixed by
ac0c00cdee
try that out
I'm getting similar CSP errors but for the S3 obj store subdomain:
E.g. main site is
pl.nudie.social
; S3 bucket @cdn.nudie.social
As far as I can tell,
ac0c00cdee
should fix that as well.@nninja Can you confirm that the fix has solved the problem you observed?
If so, I’d like to close this issue.
@nil Looks like fixed, danke!
@nninja De rien.
@floatingghost Thank you for the quick fix.