Add Support for Dynamic CSP Nonces to Enhance Security in Azure Static Web Apps
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
Currently, Azure Static Web Apps do not support Content Security Policy (CSP) nonces, which are crucial for securing inline scripts and styles under strict CSP rules. Without nonce support, it is challenging to implement a CSP that prevents the execution of potentially injected or malicious inline scripts. This limitation weakens CSP effectiveness and forces us to choose less secure configurations, increasing the security risks for our applications.
**Describe the solution you'd like**
I'd like Azure Static Web Apps to support dynamic CSP nonces. This could involve allowing us to configure nonce headers on a per-request basis or providing a mechanism within staticwebapp.config.json to dynamically generate and apply nonces to inline resources. Ideally, the feature would allow nonces to be added to responses without requiring complex workarounds, such as custom proxy functions or relying on static hashes, which do not offer the same security flexibility as nonces.
**Describe alternatives you've considered**
- **Azure Functions Proxy**: Creating a proxy endpoint with Azure Functions to inject nonce-based CSP headers, but this approach adds complexity and latency.
- **Hash-Based CSP**: Using hashes instead of nonces, which requires recalculating and updating CSP headers for every change in inline scripts or styles, making it challenging to maintain.
- **Static Nonce**: Adding a static nonce in staticwebapp.config.json, which reduces security because it can’t offer per-request uniqueness, compromising the intent of CSP nonces.
**Additional context**
Nonce support for CSP is essential for modern web security and is increasingly required for web applications handling sensitive user data. Implementing this feature would allow developers to strengthen their app’s security posture without relying on complex or less secure alternatives. This feature would also align Azure Static Web Apps with CSP best practices and bring it in line with other hosting solutions that provide better support for CSP nonces.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.