In Content Security Policy is there a way to match self + any port?

Question

In development I have a livereload server that runs on the standard port 35729, however this isn't loaded because my because my policy has script-src 'self'. Is there way to allow 'self' on all ports?

'localhost:*' also isn't a great solution because on occasions I test the site on our local network so it could be an ip address rather than 'localhost'.

Of course I can just remove this header from development if I need to but I am trying to keep it as close to live as possible.

Answer 1

No. 'self' always restricts you to the site you're in - use it if you're serving your scripts from the same application that your page is in. It's not really intended to allow resources from other processes on the same server.

You can make your sources a config or installation setting. Add localhost:* in your development config and change it to the specific resourceserver:35729 in your LAN testing environment.

Answer 2

Just to clarify - you can use wildcards for the port, but you have to specify the domain. You cannot use 'self':*

Example:

<meta http-equiv="Content-Security-Policy" content="default-src 'self' localhost:* example.com:*" />

Mozilla docs:

The site's address may include an optional leading wildcard (the asterisk character, '*'), and you may use a wildcard (again, '*') as the port number, indicating that all legal ports are valid for the source.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src#Sources