CSP improvement opportunities

I came across this issue just now which makes a good point about nonce reuse due to it being defined at build time.

I also wonder if it wouldn’t be better to set a CSP from the main process to ensure it will apply to any newly created windows? Doing it from within Electron would allow for setting nonce at runtime rather than build time, and additionally would allow for users to access the nonce for packages they use which need the value, like Emotion (and I assume Styled-Components.)

   session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
     details.responseHeaders['Content-Security-Policy'] = cspString;
     callback({ responseHeaders: details.responseHeaders });
   });

[Slapbox]

Sorry for the lengthy delay @reZach - I was leaving this unread until I could get to it, but somehow it ended up read.

The dynamic nonce approach I mentioned doesn’t seem worth the extra effort that resource hashes might have been worth.

If someone does have the bandwidth to complete that PR to satisfy the requested changes, that would probably be best - but I’m not 100% sure that that would result in the PR being merged so it’s hard to feel like it’s worth the effort (for us at least) compared with other objectives we’re working to complete.

Unless someone does undertake completing that PR, I’m in the “wait and see” boat for this one. It would be a nice security improvement, but it’s not like security is completely broken without it.

[reZach]

@Slapbox the PR was closed, I briefly read it - did you have a recommendation for moving forward with this one?