Bug 225865 - CSP sandbox policy header disables built-in media player
Summary: CSP sandbox policy header disables built-in media player
Status: RESOLVED DUPLICATE of bug 223422
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: Safari 14
Hardware: Other All
: P2 Normal
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2021-05-17 04:30 PDT by fnowak@atlassian.com
Modified: 2023-08-27 23:36 PDT (History)
6 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description fnowak@atlassian.com 2021-05-17 04:30:57 PDT
We have encountered problems with introducing "Content-Security-Policy: sandbox" header to some resources.
The issue is described here: https://jira.atlassian.com/browse/JRASERVER-72275.

Steps to reproduce:
1. Request for audio/video file and get a response with "Content-Security-Policy: sandbox" HTTP header set.

Actual results:
1. Console shows: "Blocked script execution in 'http://localhost:8080/secure/attachment/10000/100MBVideo.mp4' because the document's frame is sandboxed and the 'allow-scripts' permission is not set."
2. The video does not play.

Expected results:
1. Video plays without issues.

1. Set "Content-Security-Policy: sandbox allow-scripts" header for affected browsers.

The same issue occurs both in OS X and iOS versions of Safari, as well as iOS version of Chrome, thus we think that the problem lies within WebKit itself.
Firefox on OS X works without any issues. However, Chrome for OS X requires `allow-same-origin` instead of `allow-scripts` to function properly.

Could you please confirm if this is a bug or desired behaviour?
Comment 1 Radar WebKit Bug Importer 2021-05-24 04:31:17 PDT
Comment 2 Anne van Kesteren 2023-08-27 23:36:47 PDT
It's not desired behavior. It appears this was fixed by bug 223422. Please comment/reopen if that's not the case.

*** This bug has been marked as a duplicate of bug 223422 ***