docs(csp): clarify usage of html.cspNonce and its implications for security #20625
Conversation
|
It looks amazing, very clear. Thanks. |
|
|
||
| ### Static hosting & hashes | ||
|
|
||
| If you cannot do per-request HTML mutation, consider a hash-based CSP. A community plugin (for example `vite-plugin-csp-guard`) demonstrates a hash workflow. Hash policies allow the HTML to stay byte-for-byte cacheable because the hash values are derived at build time and stay constant as long as the content does. |
There was a problem hiding this comment.
Does this plugin work with dynamic imports? #20531 (comment)
There was a problem hiding this comment.
Yes. Hash-based CSP (like vite-plugin-csp-guard) works with dynamic import() as long as your CSP script-src still allows loading the chunk files (e.g. includes 'self' or you use a nonced/hashed entry plus 'strict-dynamic'). A hashes-only policy with neither 'self' nor 'strict-dynamic' will block dynamic imports. A nonce doesn’t conflict with long‑term cached hashed assets, just don’t give the HTML itself an immutable year-long cache or you risk version skew.
There was a problem hiding this comment.
Hash-based CSP (like vite-plugin-csp-guard) works with dynamic import() as long as your CSP
script-srcstill allows loading the chunk files (e.g. includes'self'or you use a nonced/hashed entry plus'strict-dynamic').
The reproduction linked in w3c/webappsec-csp#243 (comment) does not work for me even though the code looks fine to me. Is the setup in that repro wrong? or does vite-plugin-csp-guard implement a workaround for that issue?
Description
Docs: clarify limitations and correct usage of
html.cspNonce(fixes #20531).Adds explicit guidance that the config value is a placeholder, details required per-request server-side nonce generation and substitution, warns against static build-time nonces (security risk), explains incompatibility with immutable static SPA caching, and recommends hash-based CSP as an alternative.
Updated sections
The
shared-options.md(html.cspNonce) and CSP portion of features.md (added placeholder vs runtime note and static hosting limitations tip). No code changes; docs only.