Bug 201591 – CSP "connect-src" 'self' does not match web socket scheme as per spec

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: DOM

[TJ]

As per CSP spec paragraph 6.6.2.6, point 4. `self` match, 2nd match condition (https://w3c.github.io/webappsec-csp/#match-url-to-source-expression):

> "'self'", return "Matches" if one or more of the following conditions is met:
> ...
> 2. origin’s host is the same as url’s host, origin’s port and url’s port are either the same or the default ports for their respective schemes, and one or more of the following conditions is met:
>   - url’s scheme is "https" or "wss"
>   - origin’s scheme is "http" and url’s scheme is "http" or "ws"

This appears to not be working correctly in Safari, where I have a CSP of "connect-src 'self'" for a service worker, but the service worker refuses to connect to a web socket on the same host and port, logging error

> Refused to connect to wss://SOMEHOST/ws because it does not appear in the connect-src directive of the Content Security Policy.

Chromium had the same issue, fixed about a year ago: https://bugs.chromium.org/p/chromium/issues/detail?id=815142

Related W3C CSP Issue: https://github.com/w3c/webappsec-csp/issues/7

[Radar WebKit Bug Importer]

<rdar://problem/55227268>

[Moritz Mahringer]

I encountered this bug today and verified that it exists in Safari but works as intended (by the specification) in Chrome and Firefox. Luckily we catched this with a report-only directive.

[Michael]

Still not fixed in Safari 14.

Still present in Safari 15.3.

[Patrick Griffis]

bug 235873 probably does fix this.

[Brent Fulgham]

*** This bug has been marked as a duplicate of bug 235873 ***