HumanSignal / HumanSignal/label-studio
Content Security Policy prevents loading from minio storage
- Dominant language
- TypeScript
- Stars
- 28.3k
- Forks
- 3.7k
- Avg merge
- 14h
- Merged PRs (30d)
- 15
Description
I've connected an minio server as a LS project's Source Cloud Storage with one sample video. I've spent awhile sorting out the nginx CORS and CSP issues, but the last hurdle is getting the Django CSP to allow connecting to my minio server when loading the video (see error below).
I've tracked down the Django CSP settings here:
https://github.com/HumanSignal/label-studio/blob/cc87867f9ae1a19adb32b50d23a375c21c56d434/label_studio/core/settings/base.py#L747
There doesn't appear to be any way to add domains to these lists.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to my project
2. Click on the video in the list
3. Page shows loading bar, then it disappears, only showing "Select label and click the image to start".
4. See the following error in browser console:
`[Report Only] Refused to connect to 'https://minio.dcpud.net/foobar/Hanna%20Substation.mp4?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=NH6xweFPVhjrOWIy1jQI%2F20250212%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250212T165004Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=e41df965ba3136fb169253e804345a6837fa82cdc03d4b2e6410b2b78518fb95' because it violates the following Content Security Policy directive: "connect-src 'self' 'report-sample' https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.ingest.sentry.io".`
**Expected behavior**
The video should load in order to begin annotation.
**Environment (please complete the following information):**
- OS: docker-compose deployment on Ubuntu VM
- Label Studio Version 1.15.0
Contributor guide
Assessment
This issue has not been assessed yet.