CSP nonce support (to be able to protect against XSS attacks)

mdgriffith / elm-ui

What if you never had to write CSS again?

https://package.elm-lang.org/packages/mdgriffith/elm-ui/latest/

BSD 3-Clause "New" or "Revised" License

1.36k stars 111 forks source link

CSP nonce support (to be able to protect against XSS attacks) #337

Open jonathanmoregard opened 2 years ago

jonathanmoregard commented 2 years ago

My company uses elm-ui extensively. We need to be able to support CSP without unsafe-inline, in order to be security compliant. Elm-ui generates inlined css-styles, which are blocked by the CSP-policy we need to implement.

There is a way to get around this, using nonces. A nonce is a per-request cryptographically secure random value that is set as an attribute in the