BREAKING CHANGE SUGGESTION: remove nonce property
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.5k
- Forks
- 331
- Avg merge
- 19h 52m
- Merged PRs (30d)
- 9
Description
The Nonce feature in Nuxt Image can bring many security concerns.
The biggest ones of them all are:
- User provided nonce may not be cryptographically secure (partially or fully)
- User provided nonce may not be standard-compliant (not generated with an appropriate algorithm)
- User provided nonce may not be unique (user might reuse the nonce throughout multiple images)
It might be a better idea to leave the security of images for Nuxt Security to handle, as it takes care of all these concerns.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue concerns the Nonce feature in Nuxt Image, but it names no files, tests, or entry points. Start by locating where the nonce property is defined and used, then review the security implications and existing discussion. Done would require an agreed breaking-change scope and consistent removal of the property.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nuxt, typescript
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100