-
Notifications
You must be signed in to change notification settings - Fork 6.3k
-
Hi,
I'm trying to run code-server behind a fairly strict CSP, and getting a large number of CSP errors like this:
Refused to set the document's base URI to 'https://vscode-remote+[snip]vscode-resource.vscode-cdn.net/home/dw-user/' because it violates the following Content Security Policy directive: [snip]
Refused to load the script 'https://vscode-remote+[snip].vscode-resource.vscode-cdn.net/etc/code-server/extensions/ms-toolsai.jupyter-2024110-universal/dist/webviews/webview-side/ipywidgetsKernel/ipywidgetsKernel.js' because it violates the following Content Security Policy directive: [snip]
(And then some functionality is broken, for example Jupyter notebooks won't run/render content)
So my question are:
- Are there any work arounds to this - say some configuration to change?
- What would the minimum CSP be to get code-server to work?
Beta Was this translation helpful? Give feedback.
All reactions
Replies: 1 comment 1 reply
-
So I have got notebooks working by opening up the CSP in a dev environment, and specifically by adding https://*.vscode-resource.vscode-cdn.net/ to both the base-uri and script-src components of the CSP.
But I think this is too open for our production environment, so suggestions on how to tackle this are welcome
Beta Was this translation helpful? Give feedback.
All reactions
-
I am not entirely sure what the minimum is, VS Code already comes with CSP tags and we just use those as-is. I am not sure if they are minimal, but the main one is here:
https://github.com/microsoft/vscode/blob/main/src/vs/code/electron-sandbox/workbench/workbench.html
There are other html files with CSP tags, but I am not entirely sure which ones are relevant.
The https://vscode-remote+ URLs are interesting because, if I recall correctly, these are resolved by the service worker and not actually made as regular requests (although I could be wrong), so in theory we could make them anything. I think they have to be a different origin for security reasons, but possibly we could make it configurable.
If they are actual requests, we should change this, because we want code-server is to be fully self-contained and not reaching out to some CDN.
Beta Was this translation helpful? Give feedback.