[PR #1249] [CLOSED] Document artifact CSP support #1237

New issue

Closed

opened 2026-10-18 14:18:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:18:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/docs/pull/1249
Author: @michaellrowley
Created: 5/9/2026
Status: ❌ Closed

Base: dev ← Head: copilot/add-documentation-for-changes

📝 Commits (2)

87f3d05 Merge pull request #1247 from open-webui/dev
48513cc Document artifact CSP support

📊 Changes

3 files changed (+47 additions, -0 deletions)

View changed files

📝 docs/features/chat-conversations/chat-features/code-execution/artifacts.md (+34 -0)
📝 docs/getting-started/advanced-topics/hardening.md (+6 -0)
📝 docs/reference/env-configuration.mdx (+7 -0)

📄 Description

This pull request adds support for configuring a dedicated Content Security Policy (CSP) for artifact HTML previews in Open WebUI, allowing admins to restrict what generated artifact content can load or execute without affecting the main app's CSP. The documentation has been updated to explain this new option, how to configure it, and troubleshooting steps if CSP settings break artifact previews.

Artifact CSP support and documentation:

Added a new section to artifacts.md explaining how to secure artifact previews with a dedicated CSP, including admin panel and environment variable configuration, default behavior, and practical usage tips.
Added troubleshooting guidance for blank artifact previews caused by restrictive CSP settings, including how to diagnose and relax CSP rules.
Updated hardening.md to clarify that artifact previews can use a separate CSP (ARTIFACT_CONTENT_SECURITY_POLICY) from the main app, with a reference to the relevant documentation.
Documented the new ARTIFACT_CONTENT_SECURITY_POLICY environment variable in env-configuration.mdx, including its type, default, description, and persistence details.

https://github.com/open-webui/open-webui/pull/24512
https://github.com/open-webui/open-webui/discussions/13684

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/docs/pull/1249 **Author:** [@michaellrowley](https://github.com/michaellrowley) **Created:** 5/9/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `copilot/add-documentation-for-changes` --- ### 📝 Commits (2) - [`87f3d05`](https://github.com/open-webui/docs/commit/87f3d058ccfcd027e2f11eccff3bb7f9a1dae2f7) Merge pull request #1247 from open-webui/dev - [`48513cc`](https://github.com/open-webui/docs/commit/48513cce592c7f661a3256c935d56e11d103eee6) Document artifact CSP support ### 📊 Changes **3 files changed** (+47 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `docs/features/chat-conversations/chat-features/code-execution/artifacts.md` (+34 -0) 📝 `docs/getting-started/advanced-topics/hardening.md` (+6 -0) 📝 `docs/reference/env-configuration.mdx` (+7 -0) </details> ### 📄 Description This pull request adds support for configuring a dedicated Content Security Policy (CSP) for artifact HTML previews in Open WebUI, allowing admins to restrict what generated artifact content can load or execute without affecting the main app's CSP. The documentation has been updated to explain this new option, how to configure it, and troubleshooting steps if CSP settings break artifact previews. **Artifact CSP support and documentation:** * Added a new section to `artifacts.md` explaining how to secure artifact previews with a dedicated CSP, including admin panel and environment variable configuration, default behavior, and practical usage tips. * Added troubleshooting guidance for blank artifact previews caused by restrictive CSP settings, including how to diagnose and relax CSP rules. * Updated `hardening.md` to clarify that artifact previews can use a separate CSP (`ARTIFACT_CONTENT_SECURITY_POLICY`) from the main app, with a reference to the relevant documentation. * Documented the new `ARTIFACT_CONTENT_SECURITY_POLICY` environment variable in `env-configuration.mdx`, including its type, default, description, and persistence details. https://github.com/open-webui/open-webui/pull/24512 https://github.com/open-webui/open-webui/discussions/13684 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 14:18:12 +00:00