Repository navigation
ngCspNonce should add the nonce value to the script tags loading the main bundles #27874
Description
Activity
+1
Reacted by Tomas Trajan, Jonathan Nafziger and Francis GonzalesYes, please!
Reacted by alaingiller and Jonathan NafzigerHard to use strict-dynamic without this
Reacted by Jonathan NafzigerYes please, it would be really helpful.
Moving this to the CLI repo because it does the
index.htmlpreparation, not the Angular compiler itself.- added a commit that references this issue
on Jun 18, 2024 - added a commit that references this issue
on Jun 18, 2024 - added a commit that references this issue
on Jun 18, 2024 This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.
- locked and limited conversation to collaborators
on Jul 19, 2024
Which @angular/* package(s) are relevant/related to the feature request?
compiler-cli
Description
ngCspNonceis a great addition and almost solves a lot of the CSP difficulties I'm having but I think is missing some aspects to simplify the process of writing a CSP.CSP level 3 introduces strict-dynamic for
script-src. This avoids needing a whitelist and favours using a nonce (or hash) on scripts. The great part about it is that this "trust" given by a nonce also propagates to scripts that are loaded by the root script. This is particularly important for myself since we load a tracking script which in turn loads a bunch of other tracking services.This almost works. The problem is that you can't use
strict-dynamicin conjunction with'self'. Angular currently does not add the nonce fromngCspNonceto the runtime/main bundles included at the bottom of theindex.html. So, without a nonce or allowing "self" the browser blocks these.Proposed solution
Along with the other inline styles/scripts that
ngCspNoncewill add the nonce placeholder to, also add this nonce to the bundles.Alternatives considered
An alternate solution is to avoid
strict-dynamicuse whitelisting of domains but for an application with more complex scripts it is a lifesaver. Google's CSP evaluator utilisesstrict-dynamicin their "sample safe policy".