codeslayer1 / react-ckeditor

CKEditor component for React with plugin and custom event listeners support
MIT License
130 stars 34 forks source link

CSP error for inline event handler when CSP directives are configured #81

Open chandanch opened 3 years ago

chandanch commented 3 years ago

I'm getting this error: Refused to execute inline event handler because it violates the following Content Security Policy directive My current script src values:

'unsafe-hashes' 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa' 'nonce-EDNnf03nceIOfn39fn3e9h3sdrtyr' 'self' https://*.intercom.io https://*.intercomcdn.com https://*.walkme.com http://*.cloudflare.com 

react-ckeditor-component version: 1.1.0

A workaround would be to set unsafe-inline within script-src but that would put the react-app under some risk.

Any other way to mitigate this issue?