CSP prevents cross‐origin image preloading #263

Closed
opened 2022-11-10 15:56:03 +00:00 by nil · 8 comments

Image preloading in Pleroma-FE relies on fetch(), but the Content-Security-Policy header generated by Akkoma does not include the media sources in connect-src.

As a result, image preload requests will be blocked if the image is not loaded from the same origin.

I noticed this when trying out image preloading with a media proxy cache running on a sub‐domain (Akkoma 3.3.1, Pleroma-FE rev c8c8d40827).

Image preloading in Pleroma-FE relies on `fetch()`, but the `Content-Security-Policy` header generated by Akkoma does not include the media sources in `connect-src`. As a result, image preload requests will be blocked if the image is not loaded from the same origin. I noticed this when trying out image preloading with a media proxy cache running on a sub‐domain (Akkoma 3.3.1, Pleroma-FE rev `c8c8d40827`).

https://docs.akkoma.dev/stable/configuration/cheatsheet/#media_proxy

you may want to set base_url on the media proxy

https://docs.akkoma.dev/stable/configuration/cheatsheet/#media_proxy you may want to set base_url on the media proxy
Author

https://docs.akkoma.dev/stable/configuration/cheatsheet/#media_proxy

you may want to set base_url on the media proxy

I did exactly that, but as far as I can tell from https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/plugs/http_security_plug.ex#L107, it is only included in img-src and media-src but not in connect-src.

> https://docs.akkoma.dev/stable/configuration/cheatsheet/#media_proxy > > you may want to set base_url on the media proxy I did exactly that, but as far as I can tell from <https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/plugs/http_security_plug.ex#L107>, it is only included in `img-src` and `media-src` but not in `connect-src`.

should be fixed by ac0c00cdee

try that out

should be fixed by ac0c00cdee239 try that out

I'm getting similar CSP errors but for the S3 obj store subdomain:

image

E.g. main site is pl.nudie.social; S3 bucket @ cdn.nudie.social

I'm getting similar CSP errors but for the S3 obj store subdomain: ![image](/attachments/6131a44e-a463-4256-bd6e-53dd65cd4997) E.g. main site is `pl.nudie.social`; S3 bucket @ `cdn.nudie.social`
8.4 KiB
Author

I'm getting similar CSP errors but for the S3 obj store subdomain:

image

E.g. main site is pl.nudie.social; S3 bucket @ cdn.nudie.social

As far as I can tell, ac0c00cdee should fix that as well.

> I'm getting similar CSP errors but for the S3 obj store subdomain: > > ![image](/attachments/6131a44e-a463-4256-bd6e-53dd65cd4997) > > E.g. main site is `pl.nudie.social`; S3 bucket @ `cdn.nudie.social` As far as I can tell, ac0c00cdee239 should fix that as well.
Author

@nninja Can you confirm that the fix has solved the problem you observed?

If so, I’d like to close this issue.

@nninja Can you confirm that the fix has solved the problem you observed? If so, I’d like to close this issue.

@nil Looks like fixed, danke!

@nil Looks like fixed, danke!
Author

@nninja De rien.

@floatingghost Thank you for the quick fix.

@nninja De rien. @floatingghost Thank you for the quick fix.
nil closed this issue 2022-11-20 22:45:53 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: AkkomaGang/akkoma#263
No description provided.