3 ms·

"Avoid large inline scripts" should be 'Avoid all inline scripts' in practice. Inline scripts prevent using CSP 'unsafe-inline' therefore increasing XSS risk.

• bdibs 7y ago
  What’s wrong with the hash approach?
  • yyyk 7y ago
    It's not "wrong" in the sense of being intrinsically unsafe, but IMHO it's a bad habit which can tempt to insecurity in the end. When working with external files a programmer almost has to work with the framework, and once (s)he does that the framework - well, a modern framework - would take care of the security details and do it right. When working inline it's too easy to add a script tag manually, and from there it's a bit too easy for someone in the team to miss something (write a js without the hash/nonce and not notice the warning) or talk him/herself down to lowering security ("importing this 3rd party js is too hard, lets use just a nonce and forget about hashes", "this policy is too constraining, it's just a SMALL script, no risk here"). When working in a team, it's much better to have a hard and fast rule which forces everyone to work right. There's really no reason to use inline when using external files works really well now - and is apparently better for responsiveness too.
• eximius 7y ago
  We use the nonce feature to allow inline scripts because (for legacy reasons) we don't have server side rendering enabled for our React app
  • yyyk 7y ago
    If you're stuck with legacy that's the way it is. Note however that there are interactions between using a nonce and caching which require caution (since nonce is supposed to be used only once but caching can work against that), so proper protection here has a cost in complexity and/or speed.