No longer able to download web extensions from external CDNs

[nturinski]

I've been migrating a lot of Azure extensions to be web compatible.

In order to test these changes, we set up a pipeline that will take the web bundle and upload it to an Azure storage blob. With the SAS url, I've been able to install the extensions with the Developer: Install Extension from Location... command without much issue (except for the fact that it's a tedious process.)

Suddenly, last night (05/04/2023), I assume that an update rolled out and now a "connect-src" header is blocking all content requests that aren't officially Microsoft or localhost. I don't really understand why this change was made.

I thought that the whole point of this command is so that people can sideload their extensions in a real browser environment. I'm pretty sure that the approach mentioned in this documentation won't work anymore.

Is there another recommendation for testing web extensions? I find that testing in VS Code Desktop doesn't emulate the environment well enough to actually catch a lot of issues, especially when they are dependency related.

Error below:

[isidorn]

@joaomoreno can probably help here

[joaomoreno]

Is there another recommendation for testing web extensions?

Absolutely: https://code.visualstudio.com/api/extension-guides/web-extensions#test-your-web-extension

As we add more security to vscode.dev, we may want to deprecate side-loading extensions in this environment, or allow them via the Developer command. Can you create an issue for this?