dojo / dojo/cli-build-app

Content-Security-Policy: Usage of "'strict-dynamic'"

Open
#372 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
9
Forks
28
PR merge metrics
No merged PRs in 30d

Description

**Enhancement**

Package Version: >=2.0.0
Currently it's not possible to configure `strict-dynamic` CSP header in the application, since there is no possibility to use `nonce` attribute in the `index.html` file. Only possible solution is to manually change, after build is done, `index.html` file (script src for `runtime.js` and `main.js`) and to add desired value.

Currently is only supported to configure `nonce` attribute for dynamically loaded scripts in the app by adding following part of the code at the top of `main.ts` file:
```
// @ts-ignore
__webpack_nonce__ = 'c29tZSBjb29sIHN0cmluZyB3aWxsIHBvcCB1cCAxMjM=';
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.