Remove skipping CSP nonce on unsafe-inline
#1010
Conversation
The current implementation for Rails's CSP nonce functionality intentionally skips adding a nonce to the script tag if the script-src directive includes `unsafe-inline`. However, using both a nonce and unsafe-inline at the same time is perfectly valid (and indeed sensible) behaviour. It allows the app to maintain some level of backwards compatibility with browsers that support CSP1 but not CSP2, c.f.: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src - Remove special handling of nonces when `unsafe-inline` is specified in the `script-src` directive
|
FWIW, I can't think of anything this PR might break - my digging through the spec suggested combining a nonce and Might still be worth someone else thinking about it too though 😅 |
An issue in the rollbar gem is causing its JS output to violate our CSP and generates two CSP violation reports per page view, ironically making us go over our Rollbar quota. Until the relevant PR gets merged, this suspends CSP violation reports: rollbar/rollbar-gem#1010
|
Hiya @waltjones – just wanted to cheekily chase and ask when you expect this to be merged 😄 |
|
Released in v3.1.2. Apologies for the delay. |
|
I belive this update did in fact break our app. |
|
@pcasaretto Thank you for reporting this. I took a close look today, read your linked issue, and reviewed the CSP1 and CSP2 specs. I don't think reverting this works out well, as there are then a new set of issues. I'll work on a PR and link it here. Please feel free to give feedback there. |
Description of the change
The current implementation for Rails's CSP nonce functionality
intentionally skips adding a nonce to the script tag if the script-src
directive includes
unsafe-inline. However, using both a nonce andunsafe-inline at the same time is perfectly valid (and indeed sensible)
behaviour. It allows the app to maintain some level of backwards
compatibility with browsers that support CSP1 but not CSP2, c.f.:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
Type of change
Related issues
Fixes #1009.
Checklists
Development
Code review