I was already succesful implementing a nonce for the style-src tags as described in the docs Content Security Policy | Advanced Security Topics | Security | Flow | Vaadin Docs . I was unable to use the same mechanism to mitigate the necessity of setting ‘unsafe-inline’ (still errors are thrown that unsafe-inline is still needed). Is there a possibility to also use a nonce for the script-src directive and is there an official documentation? Or is it still needed like that to enable the bootstrap process?
Yes. It is good to note that Vaadin’s frontend bundle has unique hash-key per build generated during build time, which is injected to final code. This will protect bootstrap process.
just wanted to confirm if this thread was about style-src (mentioned in the topic) or script-src (mentioned in your message)? If you still have issues with the script-src CSP, could you please provide all error output from browser console so I could take a look what is going wrong.
Hi @Kurki
sorry that was a typo. In this thread I’m refererring to the style-src directive. For script-src it is more or less working fine. I’ll adapt it in the message above.
Thank you!
EDIT: I think the initial post can’t be editied(?). So to clarify, I’m referring in this thread to style-src
Does this mean that CSS injection is not really possible? But if it is using a hash, why is there the necessity of using unsafe-inline if there are hashes which could be used for the CSP? Can I acess these hashes to add them dynamically to the CSP Header?
Ok, thanks for the clarification. I tested this and looks like in the Flow side there’s no style injection, it comes from the Components and theme. That said, would need some changes there. Should be doable but not sure of the effort needed, I’ll try to find out.
As for the hash, I think Tatu is referring to something else there.
Update: This PR will store the nonce value in global scope. This should allow components to use the nonce value (if available) for injected styles also, but that will require a separate change in components.