DOMException in Google Chrome because of Synchronous XMLHttpRequest on the main thread is deprecated

[tomhatzer]

Bug Report

Pimcore version: 6.8.7 (but also existed on 6.7.3)

Expected behavior

New Data Object is created and listed in the Data Objects overview list.

Actual behavior

Data Object is not created and following errors are printed in the browsers console. This only happens in Google Chrome, not in Firefox or Safari or Edge. When I try to access the url mentioned in the DOMException Message I do get a response with the string I entered in the name field earlier like {"filename":"driver123"}.

Steps to reproduce

• Open pimcore admin in Google Chrome (Version 87.0.4280.141 or Version 88.0.4324.96)
• Open Google Chrome debug console
• Try creating a new Data Object by right clicking on Home -> Add Object -> Select any object that exists in your system
• Enter name for object and click "OK"
• Console will show errors from above screenshot

Important note: The pimcore demo only shows xhr request failed messages without any further details multiple times.

[brusch]

I'm not able to reproduce this on our public demo https://demo.pimcore.fun/admin/
Chrome 88.0.4324.96

[tomhatzer]

If anyone sees this thing here and needs a solution... Remove the sync-xhr=(), and sync-xhr 'none' values from your webservers permissions-policy and feature-policy CSP (content security policy) response headers.

Before eg.:

feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'self';payment 'none';
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()

After eg.:

feature-policy: geolocation 'none';midi 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'self';payment 'none';
permissions-policy: geolocation=(), midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()