Serve webviews from the same origin Normally webviews are served from vscode-webview.net but we would rather them be self-hosted. When doing this CSP will block resources (for example when viewing images) so add 'self' to the CSP to fix that. Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts @@ -240,7 +240,7 @@ export class BrowserWorkbenchEnvironment @memoize get webviewExternalEndpoint(): string { - const endpoint = this.options.webviewEndpoint + const endpoint = (this.options.webviewEndpoint && new URL(this.options.webviewEndpoint, window.location.toString()).toString()) || this.productService.webviewContentExternalBaseUrlTemplate || 'https://{{uuid}}.vscode-webview.net/{{quality}}/{{commit}}/out/vs/workbench/contrib/webview/browser/pre/'; Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts @@ -280,6 +280,7 @@ export class WebClientServer { const data = (await util.promisify(fs.readFile)(filePath)).toString() .replace('{{WORKBENCH_WEB_CONFIGURATION}}', escapeAttribute(JSON.stringify({ remoteAuthority, + webviewEndpoint: vscodeBase + '/static/out/vs/workbench/contrib/webview/browser/pre', _wrapWebWorkerExtHostInIframe, developmentOptions: { enableSmokeTestDriver: this._environmentService.driverHandle === 'web' ? true : undefined }, settingsSyncOptions: !this._environmentService.isBuilt && this._environmentService.args['enable-sync'] ? { enabled: true } : undefined, Index: code-server/lib/vscode/src/vs/workbench/api/common/shared/webview.ts =================================================================== --- code-server.orig/lib/vscode/src/vs/workbench/api/common/shared/webview.ts +++ code-server/lib/vscode/src/vs/workbench/api/common/shared/webview.ts @@ -25,7 +25,7 @@ export const webviewResourceBaseHost = ' export const webviewRootResourceAuthority = `vscode-resource.${webviewResourceBaseHost}`; -export const webviewGenericCspSource = `https://*.${webviewResourceBaseHost}`; +export const webviewGenericCspSource = `'self' https://*.${webviewResourceBaseHost}`; /** * Construct a uri that can load resources inside a webview