Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

prevent unsafe-inline CSP errors by putting all JS in their own file?

See original GitHub issue

Issue Summary

The wagtail 2.4 admin still loads some JS inline:

<!doctype html>
<html class="no-js" lang="en-gb">
<head>
    <meta charset="utf-8" />
    ...
    <link rel="shortcut icon" href="/static/wagtailadmin/images/favicon.ico" />
</head>
<body id="wagtail" class="page-explorer  ">
    ...
    <script>
        (function(document, window) {
            window.wagtailConfig = window.wagtailConfig || {};
            wagtailConfig.ADMIN_API = {
                PAGES: '/cms/api/v2beta/pages/',
                DOCUMENTS: '/cms/api/v2beta/documents/',
                IMAGES: '/cms/api/v2beta/images/',

which means that wagtail cannot be deployed on servers with a CSP that forbid unsafe-inline scripts (which is quite a sensible thing to do these days).

Steps to Reproduce

add https://github.com/jsocol/django-csp to the project
make sure the script CSP does not include unsafe-inline
load the wagtail CMS admin view with the dev console open

Making sure that all js like this is in its own file and loaded from src should solve this.

Issue Analytics

State:
Created 4 years ago
Comments:14 (12 by maintainers)

Top GitHub Comments

1reaction

lb-commented, Jun 6, 2022

@Pomax thanks for giving it a go - these things evolve slowly and yes in hindsight it’s a bit confusing. We don’t have a way to split sub-threads out.

Here is a direct link to the investigation. https://github.com/lb-/bakerydemo/blob/ui-experiments/lightweight-frontend-framework-investigation-2022.md

Here is a direct link to the code. The header search is a good example of removal of a large amount of inline scripts tags and also setting up data on data attributes where needed. https://github.com/lb-/wagtail/pull/5/files

I will post here when the RFC is up - that will give a better chance to comment.

0reactions

lb-commented, Jun 8, 2022

@Pomax as discussed

RFC 78 created https://github.com/wagtail/rfcs/pull/78