BREAKING CHANGE SUGGESTION: remove nonce property
The Nonce feature in Nuxt Image can bring many security concerns. The biggest ones of them all are:
- User provided nonce may not be cryptographically secure (partially or fully)
- User provided nonce may not be standard-compliant (not generated with an appropriate algorithm)
- User provided nonce may not be unique (user might reuse the nonce throughout multiple images)
It might be a better idea to leave the security of images for Nuxt Security to handle, as it takes care of all these concerns.
Hey @GalacticHypernova
I agree with this approach and can totally see why it could fail. Nuxt Security should handle it with nonce generation properly.
Or the upcoming CSP support for Nuxt framework in general :)
I wonder how we should approach it to not cause breaking changes instantly. Maybe we could add a note first that this prop will be deprecated with a newer version and users should use Nuxt Security instead?
I think this might be the best approach indeed. Perhaps it can become obsolete but still accepted.