Content Security Policy: The page’s settings blocked the loading of fonts

[tblaschke]

In the current code-server version (2.1692-vsc1.39.2), I get errors on the Firefox developer beta 71 that it can't load fonts.
I quick search reveals that it might be connected to #901 and the commits didn't fix all issues.

I'm getting these errors while I'm connecting to localhost and also via a reverse-proxy with SSL termination.

Content Security Policy: The page’s settings blocked the loading of a resource at data:application/font-woff2;charset=utf-… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:application/font-woff;charset=utf-8… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAJAgAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI7sAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:application/font-woff2;charset=utf-… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:application/font-woff;charset=utf-8… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAJAgAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI7sAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAIw4AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAEzMAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI7kAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI3gAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAIt0AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAIw4AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAEzMAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI7kAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAI3gAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAIt0AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAG1gAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGvEAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGz8AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGVUAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAG1gAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGvEAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGz8AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAGVUAB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAKD5AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAJd6AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAKD5AB… (“font-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at data:font/woff;base64,d09GRgABAAAAAJd6AB… (“font-src”).

[sr229]

I'm not able to replicate this, I get no errors about this on local and tried it out on a disposable environment, are you sure you got your configuration correctly?

[GeorgeXc]

Refused to load the font 'data:application/font-woff2;base64,d09GMgABAAAAAQ5sABIAAAADuOQAAQ4EAAEAgwAAAAAAAAAAAAAAAAAAAAAAAAAAG4SpIhy4XhSHMgZgAJJmCF4JgnMREAqGskiFyggSgrVoATYCJAOdOAuOXgAEIAWPGAfGYAyDGFsKfLME/nOMvX+HnQoMqyRqK6tt2TW8K2BDX9Umu4PZkCXwtMjpcHYNTx6UUmu30UdwcxxnVMvcNgAim7rdXiPZ////////////C5dF2ObuXM7ZvQeSECARwueHlaLVtkJEIaLRAI3ulswSE13cSPdM15RCyYQuuS7A0mBqpQO9pYZWQQMqa9lQb0dpJzHxHpLyCHIi8uBdwF58nNH+YOA40OpJvEjJtaokKaUkx/N5UeSinp5TWoW1vSpFjimBgeFGeCF66U0n6ZUN/qSqC4XC11GKUNmzSy2d5Jxyqw5JzGUlJUnyi0lKkE8BlxadTZsyRm8c1/Cti2hEjzIH...FVw9csGnQ1BnbMbfzgRj3WjPytwZYWpPh3OtmsLZaNcxxqaGVqMVqFffFpU8bbs/0N1vG3POWfS7LUeB81TfHn+VbD7x/UnT3lXyFltHfdX6+X6Rzmg9d4dAISK7GlTj2zgME/JUwAETAECwABAUgUmAysrKI5shRwAchnFSMheQ8UoKlvnVbkW9mMeq2+bbO9EQ2q09Z9wzsADarYt4ftoamBDi8gmfbZKnl+lkZWyRx1VYVSIpVFXs9VXy9ytCyTNYt09YIAGKjqpDT22SgOdP5OsdAK/vOCXFnrpEwA/PPTJiopB7HxZV+MlaGCT/04K/LY3kjPYV/YR146Ggg+9sX6na/c2So+Epz3PXve3PKRylPIhNZASBUYVDIGhikiWc1jj/claeVCJvljX7JfvO+xhfTDIjSXBs4HV16Ol/BMfcuFQ4NRmDOWEh6diOI6NZmGl87N9J+r2JfpW2+5NhV/fGHLO57Yavbq7zaCewa/RDxp/aSH+luOPwAA' because it violates the following Content Security Policy directive: "font-src 'self' blob:".

[erow]

This happended on my computer too, however, it worked last night. The more strange thing is that it works on firefox on the local machine which runs the server, in contrast, it throws those errors on my laptop which connects my server through a ssh tunnel proxy.

[selang]

This is caused by browser extensions. I did not go into which extension. The browser creates a new user. This is correct without adding any extensions.

[nhooyr]

Since none of us can reproduce or have had this problem, we cannot really debug. If someone runs into it again, please feel free to reopen. Especially try what @selang suggested and uninstall some browser extensions.