[PR #2624] [MERGED] Fix issue with CSP and icon redirects #3122

New issue

Closed

opened 2026-03-03 09:25:57 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 09:25:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/2624
Author: @BlackDex
Created: 7/17/2022
Status: ✅ Merged
Merged: 7/17/2022
Merged by: @dani-garcia

Base: main ← Head: fix-2623-csp-icon-redirect

📝 Commits (1)

0f95bdc Fix issue with CSP and icon redirects

📊 Changes

3 files changed (+47 additions, -32 deletions)

View changed files

📝 src/api/icons.rs (+3 -21)
📝 src/config.rs (+32 -0)
📝 src/util.rs (+12 -11)

📄 Description

When using anything else but the internal icon service it would
trigger an CSP block because the redirects were not allowed.

This PR fixes #2623 by dynamically adding the needed CSP strings.
This should also work with custom services.

For Google i needed to add an extra check because that does a redirect
it self to there gstatic.com domain.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/2624 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 7/17/2022 **Status:** ✅ Merged **Merged:** 7/17/2022 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `fix-2623-csp-icon-redirect` --- ### 📝 Commits (1) - [`0f95bdc`](https://github.com/dani-garcia/vaultwarden/commit/0f95bdc9bbf7949ca8bf436c088d5e09ea2c6e82) Fix issue with CSP and icon redirects ### 📊 Changes **3 files changed** (+47 additions, -32 deletions) <details> <summary>View changed files</summary> 📝 `src/api/icons.rs` (+3 -21) 📝 `src/config.rs` (+32 -0) 📝 `src/util.rs` (+12 -11) </details> ### 📄 Description When using anything else but the `internal` icon service it would trigger an CSP block because the redirects were not allowed. This PR fixes #2623 by dynamically adding the needed CSP strings. This should also work with custom services. For Google i needed to add an extra check because that does a redirect it self to there gstatic.com domain. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>