qwik icon indicating copy to clipboard operation
qwik copied to clipboard

[✨] nonce on styles

Open tzdesign opened this issue 2 years ago • 4 comments

Is your feature request related to a problem?

No

Describe the solution you'd like

I know that unsafe-inline in in CSP for style tags is totally ok, but I wish to have the possibility to have the nonce there anyway.

The style-tags should render with nonce if the shared map has a value for @nonce set like:

ev.sharedMap.set('@nonce', nonce);

I would do this myself, but _appendHeadStyle is so basic without additional data than ID and style, that I have no idea how to get the global context here.

Describe alternatives you've considered

unsafe-inline is ok, also suggested by google.

If you do online-banking software or similar high security apps, It would be good to have all tags secured by nonce.

Additional context

No response

tzdesign avatar Jun 05 '23 12:06 tzdesign