[Feature Request] Theme CSP nonce should be removed
Open
Nobody has claimed this yet.
E: theme
T: feature
- Dominant language
- TypeScript
- Stars
- 41k
- Forks
- 7.1k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 11
Description
Problem to solve
Theme cspNonce gives sense of false security. The nonce should be regenerated for every request or it is really not any more secure than unsafe-inline as the attacker could use the static nonce in their payload.
Proposed solution
The only real solutions are to either use a CSP hash or not generate a theme at all.
This should be documented so people find the correct solution.
The generated theme hash should not change between builds so it would need to be regenerated only if theme configuration changes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.