Skip to content

CSP nonce support (to be able to protect against XSS attacks) #337

@jonathanmoregard

Description

@jonathanmoregard

My company uses elm-ui extensively. We need to be able to support CSP without unsafe-inline, in order to be security compliant. Elm-ui generates inlined css-styles, which are blocked by the CSP-policy we need to implement.

There is a way to get around this, using nonces. A nonce is a per-request cryptographically secure random value that is set as an attribute in the <style> tag. We'd like to be able to pass the nonce as an argument to layoutWith.
This would turn all the elm-ui style tags from <style> {elm-ui-stuff} </style>, to <style nonce={passed nonce}>{elm-ui-stuff}</style>. This could be added in a function that looks like: nonce : String -> Option.

The nonce can be the same across all style tags.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions