HumanSignal / HumanSignal/label-studio

Content Security Policy prevents loading from minio storage

Open
#7,066 10 comments 0 reactions 0 assignees View on GitHub
community_needs-information
Dominant language
TypeScript
Stars
28.3k
Forks
3.7k
Avg merge
14h
Merged PRs (30d)
15

Description

I've connected an minio server as a LS project's Source Cloud Storage with one sample video. I've spent awhile sorting out the nginx CORS and CSP issues, but the last hurdle is getting the Django CSP to allow connecting to my minio server when loading the video (see error below).

I've tracked down the Django CSP settings here:

https://github.com/HumanSignal/label-studio/blob/cc87867f9ae1a19adb32b50d23a375c21c56d434/label_studio/core/settings/base.py#L747

There doesn't appear to be any way to add domains to these lists.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to my project
2. Click on the video in the list
3. Page shows loading bar, then it disappears, only showing "Select label and click the image to start".
4. See the following error in browser console:

`[Report Only] Refused to connect to 'https://minio.dcpud.net/foobar/Hanna%20Substation.mp4?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=NH6xweFPVhjrOWIy1jQI%2F20250212%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250212T165004Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=e41df965ba3136fb169253e804345a6837fa82cdc03d4b2e6410b2b78518fb95' because it violates the following Content Security Policy directive: "connect-src 'self' 'report-sample' https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.ingest.sentry.io".`

**Expected behavior**
The video should load in order to begin annotation.

**Environment (please complete the following information):**
- OS: docker-compose deployment on Ubuntu VM
- Label Studio Version 1.15.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.