Cannot run latest version on a strict webserver

[markuskrenn]

With following Apache Webserver headers (Note we are using our application behind a webserver):

Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' data:"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

I get this error on viewing an IFC/XKT model:

xeokit-bim-viewer.es.js:7039 Refused to create a worker from 'blob:https://server/296134a4-87a1-4598-ae44-aeed21e74bce' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval' data:". Note that 'worker-src' was not explicitly set, so 'default-src' is used as a fallback.

WorkerInterval @ xeokit-bim-viewer.es.js:7039
(anonym) @ xeokit-bim-viewer.es.js:7048
xkt-viewer.html:1 Uncaught DOMException: Failed to construct 'Worker': Access to the script at 'blob:https://server/296134a4-87a1-4598-ae44-aeed21e74bce' is denied by the document's Content Security Policy.
    at new WorkerInterval (https://server/xeokit/lib/xeokit-bim-viewer.es.js:7039:23)
    at https://server/xeokit/lib/xeokit-bim-viewer.es.js:7048:1

[xeolabs]

Are you able to run previous versions on this server?

[markuskrenn]

Yes, before updating to latest version we used v2.4.9-alpha-50 without problems.

[xeolabs]

Looks like a breakage introduced into @xeokit/xeokit-sdk 2.5.2-beta-32 via web-ifc 0.0.51.

Do you represent one of our partner-users? If so, please log this via our Jira and we can expedite a fix accordingly.

[xeolabs]

I just factored out the web-ifc dependency so that it's not bundled inside xeokit-sdk, and requires anyone using it to instantiate it themselves and inject it into xeokit-sdk (see PR https://github.com/xeokit/xeokit-sdk/pull/1401)

If you update to the latest xeokit-sdk (>=2.6.0-beta-1) and xeokit-bim-viewer (>=2.5.1-beta-17), you should be able to run behind a strictly-configured Apache server without the error mentioned in this issue.

This is a breaking change in xeokit-sdk for users of our WebIFCLoaderPlugin, but is not a breaking change for xeokit-bim-viewer, which does not use WebIFCLoaderPlugin.

[markuskrenn]

Downloaded and tested now v2.5.1-beta-17, but I get still this error. (currently we are using v2.5.1-beta-3 without problems)

[xeolabs]

Could you please post the newest error message from Apache (for xeokit-bim-viewer.es.js v2.5.1-beta-17)

Seems it's a different 3rd-party library attempting to create a Worker, in a way that Apache doesn't like.

Could be loaders.gl, or our own KTX texture decompressor.

[markuskrenn]

It's the same error in JS console:

xeokit-bim-viewer.es.js:7039 Refused to create a worker from 'blob:https://server/968088f8-40ca-407b-9048-c493bd839fd0' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval' data:". Note that 'worker-src' was not explicitly set, so 'default-src' is used as a fallback.

WorkerInterval @ xeokit-bim-viewer.es.js:7039
(anonym) @ xeokit-bim-viewer.es.js:7048
xkt-viewer.html:1 Uncaught DOMException: Failed to construct 'Worker': Access to the script at 'blob:https://server/968088f8-40ca-407b-9048-c493bd839fd0' is denied by the document's Content Security Policy.
    at new WorkerInterval (https://server/xeokit/lib/xeokit-bim-viewer.es.js:7039:23)
    at https://server/xeokit/lib/xeokit-bim-viewer.es.js:7048:1

[xeolabs]

OK this is caused by the Worker we use to implement a custom setTimeout interval that is able to run in a background tab, so that models can continue to load while the user has some other tab open.

See: https://github.com/xeokit/xeokit-sdk/pull/1361

It seems we have clashing requirements.

I would need to find an alternative way to implement that custom setTimeout, but nothing comes to mind right at the moment.

Is there any chance that the Apache configuration can be relaxed for this case?

[xeolabs]

Please try xeokit-bim-viewer v2.5.1-beta-18

I was using a Worker to pump the model loading queue in background tabs, and am now using a different technique - details in the release: https://github.com/xeokit/xeokit-bim-viewer/releases/tag/v2.5.1-beta-18

[markuskrenn]

Yes, now works with v2.5.1-beta-18. Thanks for the quick solution.