slackhq / csp-html-webpack-plugin

A plugin which, when combined with HTMLWebpackPlugin, adds CSP tags to the HTML output.
MIT License
164 stars 40 forks source link

Allow `nonceEnabled` to take a single boolean value #98

Open StephanBijzitter opened 3 years ago

StephanBijzitter commented 3 years ago

Description

Describe your issue here.

What type of issue is this? (place an x in one of the [ ])

Requirements (place an x in each of the [ ])


Feature Request:

Being able to enable/disable nonces for each directive is really nice, but in my specific case I want to disable all usage of nonces and the list of directives is steadily growing. If csp-html-webpack-plugin updates and adds support for a new directive, I have to remember to disable that one too, and truth be told: I'll likely forget to do that.

If the option could take a value of true to enable all (supported) directives and false to disable all, that'd be pretty nice :-)

As an example:

before:

            nonceEnabled: {
                'base-uri': false,
                'child-src': false,
                'connect-src': false,
                'default-src': false,
                'font-src': false,
                'form-action': false,
                'frame-ancestors': false,
                'frame-src': false,
                'img-src': false,
                'manifest-src': false,
                'media-src': false,
                'object-src': false,
                'script-src': false,
                'style-src': false,
                'trusted-types': false,
                'worker-src': false
            }

after:

            nonceEnabled: false
AnujRNair commented 3 years ago

That sounds good to me - would you be interested in adding this feature and test to the plugin? Thanks

StephanBijzitter commented 3 years ago

Sure!