>The 'advise' most devs gave would boil down to disabling CSP by allowing unsafe-inline, or serving the index.html through a NodeJS server and injecting CSP non

>The 'advise' most devs gave would boil down to disabling CSP by allowing unsafe-inline, or serving the index.html through a NodeJS server and injecting CSP nonces through a templating system. Both are not solutions, but workarounds to a problem that shouldn't exist. I've observed that a lot of JavaScript framework devs don't really understand web security problems and the point of mitigations such as CSP, properly. These devs manually manipulate the style attribute by concatenating strings together instead of using the DOM element `.style.styleName` properties. They inject inline scripts. Hell, the React dev tools still rely on injecting a script into most pages which fails the minute you have a strict script-src. On so many occasions I've tried to use JS libraries and had to ditch them because they were poorly written like this. The bug tracker issues are closed or often just ignored with "solutions" like you mentioned that don't fix the underlying problem and leave your app less secure.