Skip to content

Should resourceDomain be in script-src and style-src? #223

Closed
#233
Closed
Should resourceDomain be in script-src and style-src?#223
#233

Description

@connor4312
connor4312
opened on Jan 9, 2026

Raised in microsoft/vscode#286690, currently the spec says script-src and style-src should only allow safe 'unsafe-inline' https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx#4-content-security-policy-enforcement

Is this intentional or should resourceDomain be added to those too?

Activity

  1. idosal commented on Jan 9, 2026

    @idosal
    idosal
    on Jan 9, 2026
    Contributor

    Thanks @connor4312 ! Great catch, that's a bug in that part of the spec.
    The correct part is on the resourceDomains docs:

    Maps to CSP `img-src`, `script-src`, `style-src`, `font-src`, `media-src` directives

    I'll issue a fix soon.

  2. connor4312 commented on Jan 9, 2026

    @connor4312
    connor4312
    on Jan 9, 2026
    Author

    Thanks! I'll go ahead and merge their PR then 🙂

  3. ochafik
    closed this as completedin #233on Jan 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions