:lock: implement a basic CSP so that we can pass the WAVA scan - Githubissues

e-mission / em-public-dashboard

A simple and stupid public dashboard prototype.

BSD 3-Clause "New" or "Revised" License

1 stars 23 forks source link

:lock: implement a basic CSP so that we can pass the WAVA scan #85

Closed shankari closed 1 year ago

shankari commented 1 year ago

The CSP has multiple limitations:

uses unsafe-inline - I tried the nonce and it didn't work
puts everything into default-src
still has issues with the loading of some google fonts

Filed issue to have the template fixed https://github.com/NREL/nrel-app-template-bootstrap4/issues/16