RESOLVED FIXED276931
Safari ignores style-src-elem in CSP 
https://bugs.webkit.org/show_bug.cgi?id=276931
Summary Safari ignores style-src-elem in CSP
Maxim Mazurok
Reported 2024-07-22 23:15:38 PDT
In short, when using <link> and @import approach to add CSS to my website, Safari 17 (both on Mac and on iOS) doesn't let them load even though they are allowed in style-src-elem directive. Workaround is to put them into style-src directive, which is less restrictive than style-src-elem, so it isn't preferred. See https://github.com/Maxim-Mazurok/csp-safari-issue for reproduction, and follow the steps from the README.md Another reproduction I found here: https://csplite.com/csp/test235/#test (you'll need to login to see it, and 2a and 3 test will fail in Safari and pass in Chrome/Firefox). Here's the full list of user-agents that experience the same issue on our production website: Mozilla/5.0 (iPad; CPU OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPad; CPU OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 15_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/126 Mobile/15E148 Version/15.0 Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.54 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/308.0.615969171 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/319.0.638705450 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/320.0.639621854 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBAV/462.0.0.35.110;FBBV/609503125;FBDV/iPhone16,2;FBMD/iPhone;FBSN/iOS;FBSV/17.5.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_GB;FBOP/80] Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBAV/463.0.0.32.110;FBBV/612837805;FBDV/iPhone16,2;FBMD/iPhone;FBSN/iOS;FBSV/17.5.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_GB;FBOP/80] Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.49(0x18003137) NetType/WIFI Language/zh_CN Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot) Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-07-29 23:16:12 PDT
<rdar://problem/132783992>
Karl Dubost
Comment 2 2024-08-19 20:28:26 PDT
Maxim, Thanks for the reports Would you mind sharing the live site where this is happening?
Maxim Mazurok
Comment 3 2024-08-20 18:45:42 PDT
Hi Karl, Sure, here's a live website with a reproduction: https://csp-safari-issue.vercel.app/ It works in Chrome (funky font loaded), and it doesn't work in Safari (default font used). It is a deployment of the 'static' branch: https://github.com/Maxim-Mazurok/csp-safari-issue/tree/static Hope this helps!
Maxim Mazurok
Comment 4 2025-05-05 00:10:05 PDT
(In reply to Karl Dubost from comment #2) > Maxim, > > Thanks for the reports > Would you mind sharing the live site where this is happening? Hi Karl, it's been a while. I was wondering if you had a chance to check out the reproduction? It's still happening for me on Desktop Safari 18.3.1
Maxim Mazurok
Comment 5 2025-05-05 04:32:55 PDT
Same on Safari Version 18.4 (19621.1.15.111.1, 19621) on macOS 14.7.5 (23H527)
Ryan Reno
Comment 6 2025-07-29 22:06:57 PDT
Pull request: https://github.com/WebKit/WebKit/pull/48702
Karl Dubost
Comment 7 2025-07-29 22:31:32 PDT
@Maxim, Ryan found the source of the issue after investigating another public website where this is failing too.
Maxim Mazurok
Comment 8 2025-07-29 22:34:09 PDT
Awesome, thank you! I'm not familiar with WebKit sources, but PR looks promising!
Ryan Reno
Comment 9 2025-07-31 11:34:06 PDT
Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/54080
EWS
Comment 10 2025-07-31 15:04:20 PDT
Committed 298104@main (3b36e1e3244a): <https://commits.webkit.org/298104@main> Reviewed commits have been landed. Closing PR #48702 and removing active labels.
fiyaas007
Comment 11 2026-01-31 10:51:45 PST
(In reply to Maxim Mazurok from comment #0) > In short, when using <link> and @import approach to add CSS to my website, > Safari 17 (both on Mac and on iOS) doesn't let them load even though they > are allowed in style-src-elem directive. Workaround is to put them into > style-src directive, which is less restrictive than style-src-elem, so it > isn't preferred. > > See https://github.com/Maxim-Mazurok/csp-safari-issue for reproduction, and > follow the steps from the README.md > > Another reproduction I found here: https://csplite.com/csp/test235/#test > (you'll need to login to see it, and 2a and 3 test will fail in Safari and > pass in Chrome/Firefox). > > Here's the full list of user-agents that experience the same issue on our > production website: > > Mozilla/5.0 (iPad; CPU OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, > like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, > like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPad; CPU OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 15_8 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) FxiOS/126 Mobile/15E148 Version/15.0 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 > Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) CriOS/125.0.6422.80 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 > Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) CriOS/126.0.6478.153 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) CriOS/126.0.6478.54 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) GSA/308.0.615969171 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) GSA/319.0.638705450 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 > (KHTML, like Gecko) GSA/320.0.639621854 Mobile/15E148 Safari/604.1 > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 > [FBAN/FBIOS;FBAV/462.0.0.35.110;FBBV/609503125;FBDV/iPhone16,2;FBMD/iPhone; > FBSN/iOS;FBSV/17.5.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_GB;FBOP/80] > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 > [FBAN/FBIOS;FBAV/463.0.0.32.110;FBBV/612837805;FBDV/iPhone16,2;FBMD/iPhone; > FBSN/iOS;FBSV/17.5.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_GB;FBOP/80] > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 > MicroMessenger/8.0.49(0x18003137) NetType/WIFI Language/zh_CN > Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) > AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 > Safari/604.1 > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/16.3 Safari/605.1.15 > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/16.6 Safari/605.1.15 > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/17.0 Safari/605.1.15 > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; > +http://www.apple.com/go/applebot) > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/17.4.1 Safari/605.1.15 > Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, > like Gecko) Version/17.5 Safari/605.1.15 > Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like > Gecko) Chrome/125.0.0.0 Safari/537.36 > Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like > Gecko) Chrome/126.0.0.0 Safari/537.36
Maxim Mazurok
Comment 12 2026-10-08 21:31:54 PDT
Can confirm that the fix is working in Safari Version 27.0.1 (22625.1.29.11.28) Thank you!
Note You need to log in before you can comment on or make changes to this bug.