1630874 - remove csp restriction to localhost in all about pages

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Description

[lolipopplus]

STR:

1. open about:newtab
2. set up a local http api via a simulator like mockoon. At my example, it is http://localhost:3000/api/security/
3. try to reach this api using window.fecth()

Actual: request blocked by CSP

Expected: CSP shouldn't be here at all

Note: I have added Access-Control-Allow-Origin: * header.

Comment 1

[BugBot [:suhaib / :marco]]

The priority flag is not set for this bug.
:dveditz, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Tom S. (please needinfo tschuster)]

This bug sounds invalid to me. We purposefully have CSP policies for about: pages to reduce our attack surface. I see no reason to weaken them.

We won't be adding CSP to about:blank, so maybe use that for testing. Or better yet your localhost server.

Comment 3

[Daniel Veditz [:dveditz]]

Agreed w/Tom: our about: pages have elevated privileges and we intentionally disallow resources we did not ship with Firefox.

If this code is for your own benefit then I recommend building your own Firefox and customizing to your heart's content. If this is something you want to distribute then please talk to the WebExtension folks about whether new APIs and customization hooks might be appropriate. We do allow WebExtensions to completely replace about:newtab with their own content.