Open wrgoto opened 1 year ago
Maybe allow setting templateParameters, so this can also be achieved through an EJS template.
Did anyone find a workaround?
Was this fixed?
Please fix this issue. This is an insurmountable hurdle for would-be new users. Worst of all, promotes insecure coding practices. It is easy to "just get this working" while developing and then forgetting to set a proper CSP when deploying.
We faced the same issue and have added a temporary workaround. We are using the Webpack plugin and as part of the build process, we check an environment variable to determine which html template to use (for the renderer processes). We have updated our forge.config.ts
with the following parts:
First part, deciding which template to use (the CSP policy is included inside the html header of the html template):
const dev = process.env.NODE_ENV?.trim() === 'development';
const htmlTemplate = dev ? './src/renderer/index.dev.html' : './src/renderer/index.prod.html';
Second part, specifying the html template inside the renderer entry points config:
new WebpackPlugin({
mainConfig,
renderer: {
config: rendererConfig,
entryPoints: [
{
html: htmlTemplate,
js: './src/renderer/index.tsx',
name: 'renderer',
},
],
},
}),
Thanks for sharing!
May I ask how do you keep .dev and .prod in sync?
Currently we need to do that manually. We use React and the files are very small though, the only thing that differs is the CSP content. index.dev.html
looks like this:
<!doctype html>
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src *" />
</head>
<body>
<div id="app"></div>
</body>
</html>
Pre-flight checklist
Electron Forge version
6.0.5
Electron version
23.1.4
Operating system
macOS 11.7.4 (20G1120)
Last known working Electron Forge version
No response
Expected behavior
Using
devContentSecurityPolicy
in theforge.config.js
with@electron-forge/plugin-webpack
should use the content security policy given in the prop and not the content security policy specified in the meta tag inindex.html
.See: https://www.electronforge.io/config/plugins/webpack#devcontentsecuritypolicy
Actual behavior
When running
npm start
in development, it should use the specified CSP in the config.Steps to reproduce
npm start
devContentSecurityPolicy
Additional information
No response