Use the downloads API to avoid CSP issues #102
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tvdijen
reviewed
May 27, 2025
tvdijen
approved these changes
May 27, 2025
Member
tvdijen
left a comment
tvdijen
left a comment
There was a problem hiding this comment.
Oi, I think I may have caused this by introducing the CSP-headers in the latest version.. Let's do both, so also add frame-src data:; to the CSP-headers
Contributor
Author
|
Wow... How on earth did I not see those lines...?! I had been wondering for a quite long time where the CSP "suddenly" came from... 🙈😄
Why that? I think we should either use a permissive CSP (which we should not) or use the alternative proposed in this PR. But I wouldn't mix both?! |
Member
|
You're right, I dunno what I was thinking. This change should take away the need for the permissive CSP, because it's no longer triggering the issue. I'd say, go ahead and merge & release! |
khlr
added a commit
that referenced
this pull request
Jun 5, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I'm wondering if I'm the only one who (by surprise) noticed that the export fails in Firefox (and only in FF) with the following message:
Chromium based browsers seem to be fine with this. The exports succeed.
First I thought this issue would be related to our latest release (v1.9.0), but nothing was changed in regard to the export function in the first place and even v1.8.0 wouldn't export anything anymore in FF. Hence I think that FF must have tightened something in one of the last browser versions regarding CSP handling...
We could probably fix this with a more specialized CSP than
default-src 'none'but I think using the downloads API instead frees us from all those CSP hassles...