Repository navigation
Use 'self' instead of 'strict-dynamic' in script-src CSP (fixes blank UI in Chrome 158+) - #4126
Merged
tegan-temporal merged 1 commit intoNov 6, 2026
Conversation
|
Someone is attempting to deploy a commit to the Temporal Team on Vercel. A member of the Team first needs to authorize it. |
|
|
The UI is a static build, so SvelteKit's `mode: 'auto'` CSP authorizes the inline bootstrap with a hash rather than a nonce. Hashes don't propagate to the bootstrap's `import()` of the entry chunks, so under `'strict-dynamic'` those imports are parser-inserted requests with no nonce and are blocked per CSP3. This previously worked only because the entry chunks were already in the module map via <link rel="modulepreload">, and module-map hits weren't re-checked against CSP. Chrome 158 closed that bypass (chromium 78b1ee2b21, crbug.com/515948871), so the UI now loads as a blank page in Chrome 158+. Switching to `'self'` keeps the inline bootstrap hash-only and allows the same-origin `/_app/immutable/*` imports. Fixes temporalio#4125
scoobyluu
force-pushed
the
fix/csp-strict-dynamic-chrome-158
branch
from
November 5, 2026 15:15
8c018e1 to
42054a0
Compare
tegan-temporal
approved these changes
Nov 6, 2026
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
rossedfort
approved these changes
Nov 6, 2026
tegan-temporal
added a commit
that referenced
this pull request
Nov 6, 2026
Auto-generated version bump from 2.58.0 to 2.58.1 Bump type: patch Changes included: - [`ae4835ed`](ae4835e) Save at most two scaling groups when editing a Version (#4086) - [`d1b26617`](d1b2661) Fix delayed badges for time-skipped workflows (#4110) - [`31b4ed29`](31b4ed2) update Dockerfiles (#4114) - [`ebf166ed`](ebf166e) Move search into table container (#4103) - [`5696caf3`](5696caf) Raise content-tertiary contrast to meet WCAG AA (#4113) - [`120ade71`](120ade7) Implement IO TextLink (#4115) - [`fb4cc801`](fb4cc80) Add breadcrumbs component with navigation styling (#4116) - [`8c7378a7`](8c7378a) Match saved scaling groups to regions when editing a Version (#4118) - [`17729104`](1772910) Fix focus on Input clear button (#4121) - [`d1950572`](d195057) Allow Serverless Workers in only the replica region (#4119) - [`c2b35f9d`](c2b35f9) Add filtering to table header columns (#4106) - [`191a9447`](191a944) Limit status filter options to the statuses each table supports (#4135) - [`9f017f05`](9f017f0) Use 'self' instead of 'strict-dynamic' in script-src CSP (#4126) Co-authored-by: tegan-temporal <277832131+tegan-temporal@users.noreply.github.com>
vishal-seshagiri-infinitusai
added a commit
to vishal-seshagiri-infinitusai/helm-charts
that referenced
this pull request
Nov 6, 2026
Chrome 158 blocks the way UI versions before 2.58.1 load their entry scripts under their CSP, so the UI renders a blank page (temporalio/ui#4125). The fix (temporalio/ui#4126) shipped in UI v2.58.1.
1 task done
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description & motivation 💭
Fixes #4125. In Chrome 158+ the UI loads as a blank page: the CSP meta tag blocks the inline bootstrap's
import()of/_app/immutable/entry/start.*.jsandapp.*.js.Why: the UI is a static build, so
mode: 'auto'authorizes the inline bootstrap with a hash, not a nonce. Hashes don't propagate toimport(), so under'strict-dynamic'the entry imports are parser-inserted requests with no nonce, and CSP3 blocks them. This only worked before because the entry chunks were already in the module map via<link rel="modulepreload">, and module-map hits weren't re-checked against CSP. Chrome 158 closed that as a CSP bypass in chromium/chromium@78b1ee2 (crbug 515948871). Chrome 158 reaches stable on 2026-11-17.With
'self', the inline bootstrap is still hash-only, and the same-origin entry and chunk imports are allowed. Adding'self'alongside'strict-dynamic'would not work, because browsers ignore host sources when'strict-dynamic'is present.Design Considerations 🎨
Security trade-off (details in #4125):
javascript:URLs are still blocked (hash-only).<script src="/…">pointing at the same origin is allowed. The same-origin surface is only build assets./api/v1,/renderand/authcan't execute as script becausemiddleware.Secure()setsnosniff.A stronger long-term option is a per-request nonce injected by ui-server's index handler, keeping
'strict-dynamic'. That's a larger change, so this PR is the immediate fix.Testing 🧪
How was this tested 👻
Chrome 158.0.8127.19 (macOS arm64, headless),
vite buildoutput served statically:build/index.htmlCSPscript-src 'strict-dynamic' 'sha256-…'(current)Failed to fetch dynamically imported modulescript-src 'self' 'sha256-…'(this PR)A minimal repro (hashed inline
import()± modulepreload) is in #4125.Not yet tested against a running Temporal backend.
Steps for others to test: 🚶🏽♂️🚶🏽♀️
pnpm build:local, then servebuild/(e.g.python3 -m http.server --directory build).main, the same steps give a blank page.Checklists
Issue(s) closed
Fixes #4125
Docs
Any docs updates needed?
No.