Add style/script directive if nonce is true

krakenjs / lusca

Application security for express apps.

Other

1.79k stars 139 forks source link

Add style/script directive if nonce is true #114

Closed kumarrishav closed 6 years ago

kumarrishav commented 6 years ago

If app is using default-src for fall back for script-src/style-src, then nonce won't get enforced in header even if scriptNonce/styleNonce is true as these directives are no available in csp policy.

linkRace commented 6 years ago

This is great, @kumarrishav , can you just add an entry to the CHANGELOG?

kumarrishav commented 6 years ago

@linkRace done.

shaunwarman commented 6 years ago

👍