Fresh copy of code-server 4.98.2 fills the log with Content Security Policy error on Chrome #7285

Activity

1. fabgilson

   added

   bugSomething isn't workingSomething isn't working

   triageThis issue needs to be triaged by a maintainerThis issue needs to be triaged by a maintainer

   on Mar 27, 2025
2. fabgilson commented on Mar 27, 2025

   

   fabgilson

   on Mar 27, 2025

   Author

   More actions

   trace.log
3. code-asher commented on Mar 27, 2025

   

   code-asher

   on Mar 27, 2025

   Member

   More actions

   Thank you for the logs! Is your server adding any content security policies or is code-server embedded on a page with content security policies?

   One weird thing that stands out to me is that it seems to be trying to load domain.tld/hash rather than domain.tld/code-server/hash, I wonder if we are not handling the sub-path correctly somewhere. I am not seeing the same error despite also using a sub-path, but my Chrome version is older (131) so this could be new.
4. fabgilson commented on Mar 27, 2025

   

   fabgilson

   on Mar 27, 2025

   Author

   More actions

   Hello @code-asher. Thanks for your quick reply. I dug into the other nginx.conffiles (I don't have full control on the VM). I found the config that is causing the issue:

   add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; script-src-elem *  'unsafe-inline' ; font-src 'self' *; style-src * 'unsafe-inline'; img-src 'self' data: *;";
   

   The content-security-policy makes the subpath rejecting the file. Is the handling of subpath under your control, or mine?

   I can't get rid of that line, cybersecurity policy here. I'll talk to my IT team to see if I can make it more flexible for the code-server instance though.

   Thanks!
5. code-asher commented on Mar 28, 2025

   

   code-asher

   on Mar 28, 2025

   Last edited by code-asher

   Member

   More actions

   That sub-path should be under our control. We do some patching to automatically add the sub-path to various parts of VS Code, and we must have missed this one.

   Edit: although, it could also be a miss on VS Code's side. More investigation needed.
6. fabgilson commented on Mar 28, 2025

   

   fabgilson

   on Mar 28, 2025

   Author

   More actions

   Cool, thanks for confirming.
7. nowarzz commented on Apr 9, 2025

   

   nowarzz

   on Apr 9, 2025

   More actions

   It still occurs in 4.99.1 versions
8. auxtern commented on May 17, 2025

   

   auxtern

   on May 17, 2025

   More actions

   I recently tried to do something similar to what you did. I tried for hours and finally got it to work. Hopefully this will solve your problem.

   From Server
   

   With Reverse Proxy
   

   I use nginx on docker, here is the configuration:

   docker-compose.yml

   services:
     nginx-proxy:
       image: nginx:latest
       container_name: nginx-proxy
       ports:
         - "8100:80"
       volumes:
         - ./nginx.conf:/etc/nginx/nginx.conf
       extra_hosts:
         - "host.docker.internal:host-gateway"
       restart: unless-stopped
       networks:
         - proxy-network
   
   networks:
     proxy-network:
       driver: bridge
   

   nginx.conf

   events {
       worker_connections 1024;
   }
   
   http {
       server {
           listen 80;
           
           location /vscode/developer/ {
               rewrite ^/vscode/developer/(.*)$ /$1 break;
   
               proxy_pass http://host.docker.internal:8080;
               proxy_redirect off;
   
              # WebSocket headers
               proxy_http_version 1.1;
               proxy_set_header Upgrade $http_upgrade;
               proxy_set_header Connection "upgrade";
               
               # Forward original host and IP
               proxy_set_header Host 127.0.0.1:8080; # Must match the code-server port configuration.
               proxy_set_header Origin http://127.0.0.1:8080; # Must match the code-server port configuration.
               proxy_set_header X-Real-IP $remote_addr;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
               proxy_set_header X-Forwarded-Proto $scheme;
               
               # Add auth headers if needed
               proxy_set_header Cookie $http_cookie;
               proxy_set_header Authorization $http_authorization;
   
               # Increase timeout settings
               proxy_read_timeout 86400s;
               proxy_send_timeout 86400s;
           }
       }
   }

   Good luck friend 😄
9. code-asher commented on May 19, 2025

   

   code-asher

   on May 19, 2025

   Last edited by code-asher

   Member

   More actions

   Glad you got it working! I would caution against hard-coding the Origin header in the reverse proxy though, at least if either of these two scenarios apply to you: #6052 (comment)

   If you do remove the hard-coded Origin, you will also need proxy_set_header Host $http_host;.
10. auxtern commented on May 20, 2025

    

    auxtern

    on May 20, 2025

    More actions

    Thanks it works too.
    

    🎉React with 🎉3Reacted by Asher, Ponder and itdel-delcom-storages
11. ruanimal commented on Feb 25, 2026

    

    ruanimal

    on Feb 25, 2026

    More actions

    Thanks it works too.

    text

    	location / {
    		proxy_pass  http://codeserver:8443;
    		# WebSocket headers
    		proxy_http_version 1.1;
    		proxy_set_header Upgrade $http_upgrade;
    		proxy_set_header Connection "upgrade";
    		# Forward original host and IP
    		proxy_set_header Host $http_host;
    		proxy_set_header X-Real-IP $remote_addr;
    		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    		proxy_set_header X-Forwarded-Proto $scheme;
    	}
    
12. code-asher commented on Apr 7, 2026

    

    code-asher

    on Apr 7, 2026

    Member

    More actions

    Closing since the problem appears to be this problem with the origin check: #6166
13. code-asher

    closed this as not plannedon Apr 7, 2026
14. code-asher

    closed this as a duplicateof Account for hosts with/without ports in origin check #6166 on Apr 7, 2026