Error with code server using nginx proxy manager

[Kriihz77]

I get the following error for some extensions

Error loading webview: Error: Could not register service worker: SecurityError: Failed to register a ServiceWorker: The provided scriptURL ('https://domain.com/stable-6f3d0a7e5ae5f6623e1963e96adabc3287386006/static/out/vs/workbench/contrib/webview/browser/pre/service-worker.js?v=4&vscode-resource-base-authority=vscode-resource.vscode-cdn.net&remoteAuthority=domain.com') violates the Content Security Policy..

This is my docker-compose.yml file

version: '3.8'

services:
code-server:
image: lscr.io/linuxserver/code-server:latest
container_name: code-server
restart: unless-stopped
ports:
- "10400:8443"
volumes:
- ./code_server_config:/config
environment:
- PUID=1000
- PGID=1000
- TZ=America/Bogota
- PASSWORD=*****************
- SUDO_PASSWORD=*********
- DEFAULT_WORKSPACE=/config/workspace
- PROXY_DOMAIN=domain.com
- DOCKER_MODS=lscr.io/linuxserver/mods:code-server-pnpm|lscr.io/linuxserver/mods:code-server-nodejs

[Kriihz77]

This also happens with gitlens

[code-asher]

This means your browser is rejecting your certificate. Is it self-signed? You will need to make your system trust the certificate, or add an exception in your browser's settings.

[code-asher]

Or wait although that is usually the issue, this actually mentions CSP. Are you adding any CSP headers or is this embedded into a page with CSP tags? Is the origin of that URL the same as the one serving the main code-server page? Are there any other errors or warnings in the browser console?

[Kriihz77]

You generated me the doubt, so I validated the console and indeed it seems that it is a problem with a Kaspersky extension that generates that the code server extensions do not work correctly.

main.js?attr=Ad3f-BwOC0I6vuOFsJz7HnRy7QphZh3b6zZPy6NNW8lb8qPXGy1Pw6s7ax7NZNJEc3sONa8MjrDEDU9wzPj-wnAF7HVGZhCUXSDvnGf2epOQiDFEM0L0oJed5mmN1pEsdTrE1vSti8tCgs-SZcWHqlJY7BxlIcEoClNAmYWUNyJMfQuw-dVZgoAoEaEmMVtemzfvgUxksOlXfEEDYBYjw7tSQ1GkyI6jCTgFYNrj4Ns-D5tsRyHVKHl7O3hR2ebt-Q_Ddpo_MvNs9gr-CSLB9PD1czfcp8Im7-fv5MXjvBzRQ2zqaHUD62BsbQses_4D:526 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src-elem https://gc.kis.v2.scr.kaspersky-labs.com wss://gc.kis.v2.scr.kaspersky-labs.com". Either the 'unsafe-inline' keyword, a hash ('sha256-I2F0ME9oP4FOezY2caL3SBfajP3siY8eTUI+p6nH7P0='), or a nonce ('nonce-...') is required to enable inline execution.

I tried in another browser without the extension and it works correctly, I got another error, but thank you very much for the message, that gave me other ideas when validating.