Jump to content

Missing nonce attribute on inline scripts and styles

Vodafone CZ

By Vodafone CZ

  • Status: Moved to Github

If you want to deploy content security policy on your server and allow loading resources from only certain 3rd party domains, it will also block all inline scripts and styles unless you use nonce="..." attribute on them. As a workaround "unsafe-inline" could be applied in CSP, but this is not recommended 🤔

https://content-security-policy.com/unsafe-inline/

{C0D73879-79A7-4D22-808E-1BE3BA409FE2}.png

https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce

{D7A35576-D260-440D-8CC3-93A3C0A7E277}.png

more info about nonce attribute https://stackoverflow.com/questions/42922784/what-s-the-purpose-of-the-html-nonce-attribute-for-script-and-style-elements

so currently we have to use unsafe-inline https://securityheaders.com/?q=techforum.cz&followRedirects=on 😐 (its still v4 app on live server, but nothing has changed in v5)

{C84E8A56-BA87-4D89-895F-BDA5B35C53C3}.png

    •

    User Feedback

    Recommended Comments

    Marc Grand Master

    Marc

    Invision Community Team

    Sorry, you dont appear to have stated what you believe is a bug. Please could you clarify? It may well also be this is a request rather than a bug. If so, you would need to post as feedback in the feedback area, rather than as a bug report

    Vodafone CZ Collaborator

    Vodafone CZ

    Clients

    missing nonce attribute on inline scripts and styles 😮 without this attribute csp with allowed domains will break the app

    Vodafone CZ Collaborator

    Vodafone CZ

    Clients

    you can use this CSP to test, it allows only google assets (for recaptcha for example)

    default-src 'self'; script-src 'self' .google.com .gstatic.com; style-src 'self' *.gstatic.com

    without unsafe-inline values it blocks all inline scripts and styles, but such value is considered dangerous

    Vodafone CZ Collaborator

    Vodafone CZ

    Clients

    and to the solution - if the app will generate unique nonce attribute to all inline scripts and styles, we can add it to csp like this

    default-src 'self' 'nonce-xxxxx'; script-src 'self' 'nonce-xxxxx' .google.com .gstatic.com; style-src 'self' 'nonce-xxxxx' *.gstatic.com

    this wont block app inline scripts and styles and it is possible to remove the dangerous unsafe-inline values from csp

    Marc Grand Master

    Marc

    Invision Community Team

    Ive added this as a bug for you, and it can be confirmed if its not a bug

    •
    Vodafone CZ Collaborator

    Vodafone CZ

    Clients

    do know if this is going to be fixed? 🤔

    this is quite important to have content security policy configured properly due to cookies here in eu 😐

    Marc Grand Master

    Marc

    Invision Community Team

    Its still an open bug report as of yet, but it will be at some point, yes

    •