Document that Cloudflare Rocket Loader must be disabled (blank page, third report)
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 1/5
- Tiempo estimado
- Menos de una hora
- Aptitud para principiantes
- 92/100
- Tipo de issue
- Documentación
- Claridad
- Bien especificado
- Estado de actividad
- Activo
- Área
- documentation
Línea de trabajo
Edita la sección del proxy inverso de docs/guide.md, cerca de la referencia existente a Cloudflare Access alrededor de la línea 279. Empieza revisando la redacción circundante y la regla de configuración sugerida de Rocket Loader; después, añade una indicación de que debe deshabilitarse para los nombres de host de code-server. La tarea estará completa cuando la guía explique claramente el síntoma de una página en blanco y la configuración de Cloudflare con ámbito de nombre de host.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
What is your suggestion?
Document that Cloudflare's Rocket Loader must be disabled for hostnames serving code-server, in the reverse-proxy section of docs/guide.md (which already references Cloudflare Access around line 279).
Suggested wording:
Cloudflare users: disable Rocket Loader for your code-server hostname. Rocket Loader rewrites inline
<script>tags at the edge, which code-server's Content Security Policy blocks, resulting in a blank page with no visible error. Scope it with a Configuration Rule rather than disabling it zone-wide:Expression: (http.host eq "code.example.com") Setting: Rocket Loader → Off
How will this improve the docs?
This failure has now been reported three times (#1451, #4164, and my own investigation below), always as "white screen behind Cloudflare". It is hard to self-diagnose: every asset returns HTTP 200, the server logs look healthy, and the only symptom is an empty <body> plus a CSP error that does not mention Cloudflare.
The failure became easier to hit in recent releases. Comparing the CSP script-src emitted by two versions:
| 4.130.0 (loads) | 4.138.0 (blank) | |
|---|---|---|
| nonce | 'nonce-1nline-m4p' (static literal) |
random per request |
sha256 hashes |
5 | 2 |
With a static nonce, Rocket Loader's injected inline scripts copy the nonce out of the surrounding markup and still validate. With a per-request nonce and a shorter hash list they do not, so CSP blocks them and the AMD loader fails with Cannot determine URI for module id!.
I reproduced this on two independent machines behind separate Cloudflare Tunnels. Both worked on 4.130.0 and broke immediately after upgrading to 4.138.0, with no Cloudflare configuration change in between. Disabling Rocket Loader for those hostnames fixed both, with no change to the origin.
The underlying CSP change is upstream, not code-server's — patches/csp-hashes.diff is byte-identical between v4.130.0 and v4.138.0, and code serve-web 1.138.0 fails the same way with no code-server in the path. I filed that separately as microsoft/vscode#337226. This request is only about documenting the interaction, since code-server users are the ones who predominantly hit it.
One related note: in #1451 a maintainer mentioned adding "the proper tags so our scripts don't get rocket-loaded by default". That does not appear to be in effect on 4.138.0 — all six bootstrap script tags are still rewritten to type="<hash>-text/javascript". If that mitigation is still wanted, it would remove the need for the docs change; otherwise documenting the workaround seems like the cheaper fix.
Are you interested in submitting a PR for this?
Yes, happy to open a PR against docs/guide.md if you would like the wording above (or something closer to your house style).
- Lenguaje dominante
- TypeScript
- Estrellas
- 79.4k
- Forks
- 6.9k
- Merge medio
- 2 d 13 h
- PR fusionados (30 d)
- 39
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de coder/code-server
-
Bump proxy-addr to 2.0.8 Abiertosecurity
Dificultad 2/5 1-3 horas Aptitud para principiantes 74/100
coder/code-server#8013 · 4 comentarios ·
-
enhancement
Dificultad 5/5 Más de una semana Aptitud para principiantes 35/100
coder/code-server#7976 · 2 comentarios ·
-
enhancement
Dificultad 5/5 Más de una semana Aptitud para principiantes 35/100
coder/code-server#7962 · 3 comentarios ·
-
bug needs-investigation
Dificultad 4/5 3-5 días Aptitud para principiantes 55/100
coder/code-server#7955 · 1 comentario ·
-
enhancement
Dificultad 5/5 Más de una semana Aptitud para principiantes 42/100
coder/code-server#7948 · 1 comentario · 2 reacciones ·
Todos los issues de coder/code-server
Issues similares
-
[Bug]: Discord Activity titles with emoji are rejected as over 80 characters when they are not Abiertoclawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
supermomonga/zcode-acp#24 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
growthbook/growthbook#7100 ·
-
triage
Dificultad 1/5 1-3 horas Aptitud para principiantes 88/100