Skip to content

CSP Nonce Support for generated files #1392

@MrMcGibblets

Description

@MrMcGibblets

Stencil version:

 @stencil/core@0.18.0

I'm submitting a:
[ ] bug report
[x] feature request
[ ] support request => Please do not submit support requests here, use one of these channels: https://stencil-worldwide.herokuapp.com/ or https://forum.ionicframework.com/

Current behavior:
Same as the closed issue - #496

When bundling we automatically create an inline style which violates the strict CSP usage

Whilst a workaround is to add each individual sha to the CSP policy it isn't ideal and not a nice dev experience.

In webpack this was achieved by adding a top-level nonce value which would then be added to all at bundle time. - styled-components/styled-components#887

Expected behavior:
To be able to provide a nonce for styles (should be for all scripts, img etc...) that will be added to all build-generated scripts, styles etc... Allowing apps to be CSP ready out of the box.

Steps to reproduce:
Add CSP Policy for style-src 'self' and run app.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature: Want this? Upvote it!This PR or Issue may be a great consideration for a future idea.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions