2 ms·
CSPs are hard to get right, but they're doable. Most occurrences of script unsafe-inline and unsafe-eval are due to laziness. As far as I know -- and I use Reac
by ezekg 5y ago
CSPs are hard to get right, but they're doable. Most occurrences of script unsafe-inline and unsafe-eval are due to laziness. As far as I know -- and I use React regularly -- there's nothing about React that makes a strong CSP harder vs normal DOM manipulations.
- iancarroll 5y agoIt's also worth noting that 'unsafe-inline' in CSP is commonly used to support older browsers, and a nonce subsequently disables the unsafe directive for modern browsers that support it. It can be hard to read a policy visually and see if the directive actually applies. (The same thing happens with 'strict-dynamic' and allowing all HTTP(S) URIs -- 'strict-dynamic' disables the URIs when supported.) ref: https://csp.withgoogle.com/docs/strict-csp.html#example https://csp.withgoogle.com/docs/strict-csp.html#example