Closed
Bug 806752
Opened 12 years ago
Closed 12 years ago
Web worker does not respect CSP
Categories
(Core :: DOM: Workers, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 609748
People
(Reporter: mmitar, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:16.0) Gecko/20100101 Firefox/16.0
Build ID: 20121024073032
Steps to reproduce:
I have a website at "example.com" and I am serving all external resources from "cdn.example.com". So in my HTML page at "example.com" I have something like:
<script type="text/javascript" src="http://cdn.example.com/script.js"></script>
In my script I want to create a web worker, so I do:
worker = new Worker("http://cdn.example.com/script.js");
Actual results:
This fails on Firefox 16 with "Failed to load script: http://cdn.example.com/script.js (nsresult = 0x805303f4)" error. It works on Safari 6 and Chrome 22.
It seems the problem is because origins differ. Effective origin of the script is "example.com" and "cdn.example.com" does not match that. This seems a bug because not CORS not setting "document.domain" helps (or at least I couldn't make it to work by playing with that). I tried also setting CPS headers to "x-content-security-policy: default-src 'self' example.com cdn.example.com" but it still does not work.
Expected results:
That a script loaded by a page could execute itself as a web worker (which works in Safari 6 and Chrome 22). Or that at least some other way of enabling this would work.
Summary: Web worker does not respect CPS → Web worker does not respect CSP
This should be fixed for Firefox 18. Could you check to see if this is working as it should in nightlies or aurora?
Status: UNCONFIRMED → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•