Closed Bug 806752 Opened 12 years ago Closed 12 years ago

Web worker does not respect CSP

Categories

(Core :: DOM: Workers, defect)

16 Branch
x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 609748

People

(Reporter: mmitar, Unassigned)

Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:16.0) Gecko/20100101 Firefox/16.0 Build ID: 20121024073032 Steps to reproduce: I have a website at "example.com" and I am serving all external resources from "cdn.example.com". So in my HTML page at "example.com" I have something like: <script type="text/javascript" src="http://cdn.example.com/script.js"></script> In my script I want to create a web worker, so I do: worker = new Worker("http://cdn.example.com/script.js"); Actual results: This fails on Firefox 16 with "Failed to load script: http://cdn.example.com/script.js (nsresult = 0x805303f4)" error. It works on Safari 6 and Chrome 22. It seems the problem is because origins differ. Effective origin of the script is "example.com" and "cdn.example.com" does not match that. This seems a bug because not CORS not setting "document.domain" helps (or at least I couldn't make it to work by playing with that). I tried also setting CPS headers to "x-content-security-policy: default-src 'self' example.com cdn.example.com" but it still does not work. Expected results: That a script loaded by a page could execute itself as a web worker (which works in Safari 6 and Chrome 22). Or that at least some other way of enabling this would work.
Component: Untriaged → DOM: Workers
Product: Firefox → Core
Summary: Web worker does not respect CPS → Web worker does not respect CSP
This should be fixed for Firefox 18. Could you check to see if this is working as it should in nightlies or aurora?
Status: UNCONFIRMED → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.