[GH-ISSUE #13] CSP: Safari does not load Script / connect to WebSocket due to CSP errors #12

New issue

Closed

opened 2026-03-15 12:03:12 +03:00 by kerem · 4 comments

kerem commented

2026-03-15 12:03:12 +03:00

Owner

Originally created by @SunflowerFuchs on GitHub (Sep 19, 2022).
Original GitHub issue: https://github.com/axllent/mailpit/issues/13

Safari handles the CSP differently and refuses to run Scripts / connect to the WebSocket. Chrome
It throws the following errors for me:

Setup:
I'm running Mailpit via docker (latest image) and access it via the current Safari (Version 15.6.1 (17613.3.9.1.16)) on MacOS Monterey Version 12.5.1.

As a workaround i've downgraded back to 1.1.3, so it's at least not an immediate issue for me.

Related:
It seems as if the connect-src 'self' issue is already known and has possibly been fixed in an upcoming version of safari:
https://github.com/w3c/webappsec-csp/issues/7

Originally created by @SunflowerFuchs on GitHub (Sep 19, 2022). Original GitHub issue: https://github.com/axllent/mailpit/issues/13 Safari handles the CSP differently and refuses to run Scripts / connect to the WebSocket. Chrome It throws the following errors for me: ![image](https://user-images.githubusercontent.com/18332886/190986460-75d3c65a-8d18-4f9a-977b-928c044b3c68.png) Setup: I'm running Mailpit via docker (latest image) and access it via the current Safari (Version 15.6.1 (17613.3.9.1.16)) on MacOS Monterey Version 12.5.1. As a workaround i've downgraded back to 1.1.3, so it's at least not an immediate issue for me. Related: It seems as if the `connect-src 'self'` issue is already known and has possibly been fixed in an upcoming version of safari: https://github.com/w3c/webappsec-csp/issues/7

kerem closed this issue

2026-03-15 12:03:18 +03:00

kerem commented

2026-03-15 12:03:23 +03:00

Author

Owner

@SunflowerFuchs commented on GitHub (Sep 19, 2022):

I've installed the Safari Technology Preview and tested it there, and there are no more errors there, everything works fine.
This means that this is issue possibly mostly relevant as documentation for others encountering this problem, and doesn't need any actual code changes.

@SunflowerFuchs commented on GitHub (Sep 19, 2022): I've installed the Safari Technology Preview and tested it there, and there are no more errors there, everything works fine. This means that this is issue possibly mostly relevant as documentation for others encountering this problem, and doesn't need any actual code changes.

kerem commented

2026-03-15 12:03:29 +03:00

Author

Owner

@axllent commented on GitHub (Sep 19, 2022):

@SunflowerFuchs, firstly thank you for not only reporting the Safari compatibility issue, but also for finding and linking the known bug, plus of course testing with the technology preview version.

I think that the reasons for those HTTP headers are (or at least should be) obvious - to prevent the loading & execution of remote JavaScript stored in any email. This is a security precaution since emails are rendered in the browser vs: an email client which lacks many of the browser's capabilities.

I found that by adding ws: and wss: to the list of connect-src options in the HTTP header is a good work-around for the issue, and appears to resolve the issue here in my testing (I was able to replicate it in my virtual Mac). The new docker release should be ready in the next 10 minutes for testing. Please re-open if still an issue for you (with the current stable version of Sarafi), else please also comment back if it resolves it for you. Apologies, my git commit auto-closed the GitHub issue.

@axllent commented on GitHub (Sep 19, 2022): @SunflowerFuchs, firstly thank you for not only reporting the Safari compatibility issue, but also for finding and linking the known bug, plus of course testing with the technology preview version. I think that the reasons for those HTTP headers are (or at least should be) obvious - to prevent the loading & execution of remote JavaScript stored in any email. This is a security precaution since emails are rendered in the browser vs: an email client which lacks many of the browser's capabilities. I found that by adding `ws:` and `wss:` to the list of `connect-src` options in the HTTP header is a good work-around for the issue, and appears to resolve the issue here in my testing (I was able to replicate it in my virtual Mac). The new docker release should be ready in the next 10 minutes for testing. Please re-open if still an issue for you (with the current stable version of Sarafi), else please also comment back if it resolves it for you. Apologies, my git commit auto-closed the GitHub issue.

kerem commented

2026-03-15 12:03:34 +03:00

Author

Owner

@SunflowerFuchs commented on GitHub (Sep 19, 2022):

I've just pulled the latest image, i can confirm that everything works again. Thank you so much for the quick fix.

@SunflowerFuchs commented on GitHub (Sep 19, 2022): I've just pulled the latest image, i can confirm that everything works again. Thank you so much for the quick fix.

kerem commented

2026-03-15 12:03:39 +03:00

Author

Owner

@axllent commented on GitHub (Sep 19, 2022):

Glad to hear it, and thanks again for testing & the bug report!

@axllent commented on GitHub (Sep 19, 2022): Glad to hear it, and thanks again for testing & the bug report!

kerem referenced this issue

2026-03-15 12:05:41 +03:00

[GH-ISSUE #15] OpenAPI Specification #13