Loading JavaScript through a local server is typically used in development of userscripts. The CSP change earlier added https://localhost but not http://localhost. I don't know whether there's any risk of eavesdropping from Wikipedia to localhost. 127.0.0.1 might also need to be added.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Allow-list some additional domains to the currently enforcing CSP | operations/puppet | production | +1 -1 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T419265 CSP adjustments related to the 2026 user javascript incident | |||
| Resolved | BUG REPORT | sbassett | T419197 new CSP only allows localhost over TLS |
Event Timeline
Comment Actions
If possible, I'd like to request that localhost:* also be allowed. Without this, web servers would need to run on port 443 only (for https), which usually requires admin privileges and is a bit too inconvenient.
Comment Actions
We are now supporting http://localhost:* and https://localhost:* within the enforcing CSP, which hopefully unblocks this issue. (relevant config patch)
Comment Actions
Change #1249348 had a related patch set uploaded (by SBassett; author: SBassett):
[operations/puppet@production] Allow-list some additional domains to the currently enforcing CSP
Comment Actions
Change #1249348 merged by Scott French:
[operations/puppet@production] Allow-list some additional domains to the currently enforcing CSP