Nx React and Content Security Policy (CSP)

Current Behavior

“INLINE_RUNTIME_CHUNK=false” command does not work with NX React. I would use this to avoid the use of ‘unsafe-inline’ for style-src CSP directive

In a normal React app I would use "build": "set \"INLINE_RUNTIME_CHUNK=false\" && react-scripts build" and this would enable my CSPs to work properly

I have tried the following in my pipeline script: set \"INLINE_RUNTIME_CHUNK=false\" && npx nx affected --base=HEAD~1 --target=build but this doesn’t work

Is there a way to use “INLINE_RUNTIME_CHUNK=false” when using NX?

Can you advise why #2932 was closed? This seems like a security issue that needs to be resolved to me?

More info https://drag13.io/posts/react-inline-runtimer-chunk/index.html

Expected Behavior

You should be able to have “INLINE_RUNTIME_CHUNK=false” when using NX otherwise having CSPs breaks the application

[72gm]

A workaround is to use ‘unsafe-inline’.

This isn’t ideal as it reduces the security rating from “A+” to “A” when scanning at https://securityheaders.com/ (hopefully my security team will let this pass)

Are there any plans to add such a config option to NX that create-react-app has?

Might be something you want to give some consideration to given nx.dev’s rating https://securityheaders.com/?q=https%3A%2F%2Fnx.dev%2F&followRedirects=on

[sayeedhussain]

Hello Maintainers,

@FrozenPandaz, @vsavkin, @bcabanes , @jaysoo , @meeroslav , @leosvelperez

This seems to be a security concern. Can you please let us know your plan to address this?