immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Unsafe inline javascript SvelteKit and FOUC #7630

New Issue
Open
opened 2026-02-05 13:11:23 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 13:11:23 +03:00
Owner
Copy Link

Originally created by @falk0069 on GitHub (Oct 26, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

I noticed the immich app includes inline <script> blocks--specifically the SvelteKit bootstrap script and a theme-handling FOUC script. This means folks must loosen their Content Security Policy and use (script-src 'unsafe-inline') or use CSP hashes when passing through a proxy--for example if you use Nginx or Apache to add in https.

I can get things to work by adding two specific CSP hashes (avoiding unsafe-inline):
script-src 'self' 'sha256-bg3FIHOuVoNHVJLkqZbqiu0hzzZyDtUDjMV49UQz4dI=' 'sha256-h5wSYKWbmHcoYTdkHNNguMswVNCphpvwW+uxooXhF/Y=';

But this does change every time we upgrade.

Could these scripts be moved to an external JavaScript file? This way, CSP can stay strict (script-src 'self') without needing 'unsafe-inline' or hashes. Externalizing them is considered a best practice in modern web security guidance and avoid the increased risk of cross-site scripting (xss) vulnerabilities.

Thanks for considering

The OS that Immich Server is running on

Rocky Linux 9.6

Version of Immich Server

v2.1.0

Version of Immich Mobile App

2.1.0

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

N/A

Your docker-compose.yml content

N/A

Your .env content

N/A

Reproduction steps

  1. Set an http Content-Security-Policy header similar to this on the proxy:
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; form-action 'self';"
  2. Access the site

Relevant log output

Additional information

No response

Originally created by @falk0069 on GitHub (Oct 26, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug I noticed the immich app includes inline <script> blocks--specifically the SvelteKit bootstrap script and a theme-handling FOUC script. This means folks must loosen their Content Security Policy and use (script-src 'unsafe-inline') or use CSP hashes when passing through a proxy--for example if you use Nginx or Apache to add in https. I can get things to work by adding two specific CSP hashes (avoiding unsafe-inline): script-src 'self' 'sha256-bg3FIHOuVoNHVJLkqZbqiu0hzzZyDtUDjMV49UQz4dI=' 'sha256-h5wSYKWbmHcoYTdkHNNguMswVNCphpvwW+uxooXhF/Y='; But this does change every time we upgrade. Could these scripts be moved to an external JavaScript file? This way, CSP can stay strict (script-src 'self') without needing 'unsafe-inline' or hashes. Externalizing them is considered a best practice in modern web security guidance and avoid the increased risk of cross-site scripting (xss) vulnerabilities. Thanks for considering ### The OS that Immich Server is running on Rocky Linux 9.6 ### Version of Immich Server v2.1.0 ### Version of Immich Mobile App 2.1.0 ### Platform with the issue - [x] Server - [ ] Web - [ ] Mobile ### Device make and model N/A ### Your docker-compose.yml content ```YAML N/A ``` ### Your .env content ```Shell N/A ``` ### Reproduction steps 1. Set an http Content-Security-Policy header similar to this on the proxy: Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; form-action 'self';" 2. Access the site ### Relevant log output ```shell ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 13:11:25 +03:00
Author
Owner
Copy Link

@Metzlmane commented on GitHub (Oct 31, 2025):

exactly same issue for me, upgraded from 2.1.0 to 2.2.0 and now images don't load anymore

@Metzlmane commented on GitHub (Oct 31, 2025): exactly same issue for me, upgraded from 2.1.0 to 2.2.0 and now images don't load anymore
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7630
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?