Content Security Policy nonce option is not working
See original GitHub issueDescribe the bug
The possibility to add a cspNonce
was introduced in this MR https://github.com/mbrn/material-table/pull/1438.
The problem is that material-table
depends on the package react-beautiful-dnd
version 11.0.31
which does not have the option to pass a cspNonce
as a property.
To Reproduce Steps to reproduce the behaviour:
- Set up a CSP where the style src is not set to unsafe-inline
- Use material-table
Expected behaviour There should be no CSP errors but there is. This is because the react-beautiful-dnd library sets inline styles.
Screenshots
Desktop :
- OS: Ubuntu
- Browser Firefox
- Version 77.0.1
Issue Analytics
- State:
- Created 3 years ago
- Comments:8 (3 by maintainers)
Top Results From Across the Web
Content Security Policy nonce does not apply to event handler ...
Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src self https: 'nonce- ...
Read more >CSP Nonce Examples and Guide - Content Security Policy
Using a nonce is one of the easiest ways to allow the execution of inline scripts in a Content Security Policy (CSP). Here's...
Read more >CSP: script-src - HTTP - MDN Web Docs - Mozilla
The HTTP Content-Security-Policy (CSP) script-src directive specifies valid sources for JavaScript. This includes not only URLs loaded directly ...
Read more >Does not support Content Security Policy (CSP) nonce, only ...
In summary they are only for script tags, not style attributes, and it requires the server side to generate a new nonce for...
Read more >FAQ - Content Security Policy
What if my application uses Service Workers? How do I make my favorite JS library/widget/CMS compatible with nonce-based CSP? Why does the strict...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
You need to specify the nonce to the
MaterialTable
component. It will then be passed down to the style tag ofreact-beautiful-dnd
.The problem with the icons is not related with the CSP. You need to install
@material-ui/icons
and import them as it is described in the readme.ah, ok, thanks a lot @MglMX ! I thought the nonce is added by setting webpack_nonce so webpack is generating these tags… For now I will modify all the tables to include the nonce, hope it can be set dynamically in the table in the future. Thanks again for the help! Really appreciated.