Its possible set Content Security Policy rules in configuration file?

Troubleshooting
1

Hi

I would like to be able to add the following rule to the CSP from a configuration file or from the frontend so as not to have to modify server code.

The rule that I would like to add is media-src ‘self’ blob:

Its possible?

The modification in the server look like this:

image
image1175×57 12.2 KB

Thanks

2

Hi @sebaripari,

Would you be open to sharing more details on why you’re looking to make this change?

3

Hello @amy.blais !! Yes because in mattermost-webapp I’m using a library, Tone JS, that does import of blob and CSP block the page

This is the error:

Screenshot%20from%202019-05-14%2014-14-36
Screenshot%20from%202019-05-14%2014-14-361858×135 40.5 KB

4

Hi @sebaripari,

we currently don’t support this on an application level, however, you can overwrite the headers in NGINX or the proxy solution you are using. Please be aware that this might have potential security impact.

1 Like
5

Thanks @DSchalla

I will try overwriting the headers