Setting the document's base URI violates the following CSP directive: "base-uri 'self'"

ChatGPT Apps SDK
1

When an MCP server exposes OpenAI CSP rules, the sandbox automatically adds a meta tag to its iframe containing all the rules. It also includes a base-uri ‘self’ directive whose value does not seem to be configurable at the moment.

This directive prevents the use of an HTML tag, which previously allowed the use of relative paths for assets such as images. When using Vite, for example, this makes necessary to rewrite all relative paths to full URLs by prefixing them with an origin during the build phase.

I understand this has been done for security reasons, but would it be possible to make it configurable in the resource meta object? It should not pose any security risk if the domain used as the base is declared in the server CSP configuration.

5 Likes
2

Was about to raise the same issue.

I’m about to submit my first app and currently not sure how to best handle it.

3

We implemented a temporary workaround in the skybridge framework, maybe you will find it useful. It works by rewriting all the relative urls as absolute to avoid having to rely on the tag.

1 Like