search

w3c / webappsec-csp

WebAppSec Content Security Policy
https://w3c.github.io/webappsec-csp/
Other
209 stars 78 forks source link

CSP: connect-src 'self' and websockets #7

Closed mikewest closed 4 years ago

mikewest commented 9 years ago

From @klings on September 28, 2015 19:25

Declaring a CSP with connect-src ‘self’ will not allow websockets back to the same host/port, since they're not same origin. This might come as a surprise to developers that haven't studied the CSP specification in detail and have a firm grasp of the same origin security model.

One option could be to add a note to the spec to clarify that this is the intended behaviour. Another option could be to make an exception for connect-src 'self', and allow ws(s): requests to same host/port.

I'm not sure what the security implications could be of the latter, but it might be worth some consideration.

Copied from original issue: w3c/webappsec#489

zdexter commented 9 years ago

I'm not sure this should be intended behavior - what about the "load web page in browser, then make websocket connection" use case? Nobody wants to enumerate all possible websocket origins in server configuration files or switch on development/production/staging hostnames... that's the utility of 'self' in the first place. Described scenario here: https://github.com/w3c/webappsec/issues/506.

mikewest commented 9 years ago

Poked at this in https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b9697ff7b60, WDYT?

klings commented 9 years ago

Thanks for looking into this! This should do the trick for same host/port web sockets.

amacneil commented 8 years ago

Would it also be possible to support ws: if the current protocol is http: and the CSP allows connect-src 'self'? It sounds like as written self will only support wss: if the current page was served via http.

As an example, it would be useful to serve a page at http://localhost:3000/ using connect-src 'self', and have this behave as if the CSP (under current rules) had specified connect-src 'self' ws://localhost:3000.

thapet commented 7 years ago

This seems still to be an issue - like amacneil described. I have tried with connect-src 'self', but ws request to same origin (host and port) does not work (when testing from remote machine). I have tried with Chrome v.59 and Edge v.14.

annevk commented 6 years ago

Reopening this per recent comment. It seems this wasn't fixed properly yet.

emilfihlman commented 6 years ago

Issue opened at: https://bugs.chromium.org/p/chromium/issues/detail?id=815142

emilfihlman commented 6 years ago

New development https://bugs.chromium.org/p/chromium/issues/detail?id=815142#c8

Thesephi commented 5 years ago

Sincere apologies if I'm asking in a wrong thread, but I think Safari also has the same issue as specified in a previous comment by thabet (although I tested with https & wss) (I tested on Safari 12.1.1 and Safari Technology Preview Release 87 (Safari 13.0, WebKit 14608.1.33.1)). Internet search didn't result in productive findings, so I decided to ask here. Could anyone else reproduce?

wss_https_safari

ratiofu commented 5 years ago

@Thesephi I can reproduce in Safari 12.1.2 with CSP connect-src 'self'. In fact, because of that error, I landed here. I filed WebKit bug 201591

MoxxiManagarm commented 4 years ago

I just came here because of the same. Still reproducable with Safari 13. Other browser accept wss to self with connect-src 'self' defined.

mikewest commented 4 years ago

I believe the spec is correct, and covered by https://wpt.fyi/results/content-security-policy/connect-src/connect-src-websocket-self.sub.html?label=experimental&label=master&aligned. Closing this out again, as the bug against WebKit is the right place to comment on priority.

/cc @johnwilander

mkurz commented 2 years ago

There is finally work going on to get this fixed in Safari: https://bugs.webkit.org/show_bug.cgi?id=235873 (before it was https://bugs.webkit.org/show_bug.cgi?id=201591, which was marked as duplicate)

mkurz commented 2 years ago

https://bugs.webkit.org/show_bug.cgi?id=235873 is finally resolved now, so this should be fixed in the next Safari release 16 (maybe even 15.5 or 15.6 if those will happen)

silverwind commented 11 months ago

Maybe it's a regression but I do observe this exact issue in Firefox 120.0b9 where connect-src: self does not allow ws://localhost:3000 when origin is http://localhost:3000. Works fine on 119.0.1.

mkurz commented 11 months ago

@silverwind I think you should report that to the firefox bug tracker?

silverwind commented 11 months ago

I will if I reproduce again. Strangely enough downgrading and upgrading Firefox seems to have resolved it for now.

skyzyx commented 4 months ago

I spent way too much time today going spelunking through issues and patch notes this morning.

The WPT test for this was added in September 2018.