如何在 pdf.js 中使用 CSP？ 我和工人有问题

Question

MVC c# application. I'm using CSP, with this format:

<meta http-equiv="Content-Security-Policy" content="
    default-src 'self';
    script-src 'self' https://mozilla.github.io/pdf.js/build/pdf.js https://mozilla.github.io/pdf.js/build/pdf.worker.js;
    style-src  'self' https://meyerweb.com/eric/tools/css/reset/reset.css;
    object-src 'self';
    base-uri 'self';
    connect-src 'self';
    font-src 'self';
    frame-src 'self';
    img-src 'self';
    manifest-src 'self';
    media-src 'self';
    worker-src blob:;"/>

In the proyect, i use pdf.js for base64 pdfs. I see my documents, but I dont see the buttons bar from pdf.js. My browser console shows:

and my javascript function use:

var DivContenedorPDF = document.createElement("div");
DivContenedorPDF.id = "pdf-viewer";
var pdfData = atob(b64);
var pdfjsLib = window['pdfjs-dist/build/pdf'];
pdfjsLib.GlobalWorkerOptions.workerSrc = '//mozilla.github.io/pdf.js/build/pdf.worker.js';....

I tried add blob: in default-src, using local pdf.js (this has not errors but not work)...

extra info:

• api.js is part of pdf.js webpack.
• My test are in pre-production (in localhost,console throws 0 errors).
• I dont have CSS for pdf.js buttons bar.

thanks in advance!

Answer 1

尝试将 blob: 添加到 script-src。

Answer 2

Your browser console shown CSP:

default-src https: data: 'unsafe-inline' *.google.com

that differs you shown in the meta-tag:

default-src 'self'; ...

Looks like in fact you does issue Content-Security-Policy elsewhere than you think (and edit).

worker-src blob: in the meta-tag is totally enough to allow worker creation from blob-URL.

Answer 3

@granty gave me the answer: the message in console isn't generic. I don't know why, but my IIS used another CSP configuration. My code works deleting the configuration in response header section of IIS.