search

nelmio / NelmioSecurityBundle

Adds extra security-related features in your Symfony application
https://symfony.com/bundles/NelmioSecurityBundle/
MIT License
651 stars 85 forks source link

Do not add signatures if `unsafe-inline` is enabled #335

Open fritzmg opened 9 months ago

fritzmg commented 9 months ago

Currently signatures are explicitly still added, even if unsafe-inline was already present in the script-src or style-src directive. However, if your application adds a lot of hashes (for style="…" for example) and you decide to instead allow unsafe-inline in general, the hashes are still output in the response header. This might lead to the response header size being too large, if there are a lot of long hashes for example

This PR would automatically not apply any signatures, if unsafe-inline was enabled.

wdyt?