mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-08-19 13:46:13 +00:00
Code Issues Releases Wiki Activity

Fix CSP directive in production (#3176)

Browse Source 
In prod, when loading the console, we were failing to get some
scripts/styles with the error "Executing
  inline event handler violates the following Content Security Policy directive 'script-src
  'self''. Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-
  ...') is required to enable inline execution. Note that hashes do not apply to event
  handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword
  is present. The action has been blocked."

We fix this by disabling inline-critical optimization for prod in the
angular file.

In addition, the web.xml header values are comma-separated -- we forgot
one comma before.
This commit is contained in:
gbrodman
2026-07-23 21:00:18 +00:00
committed by GitHub
parent 12ab7f47e2
commit 53b6044ff8
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml
+2 -2
View File
@@ -9,8 +9,8 @@
<init-param>
<param-name>headerConfig</param-name>
<param-value>
set Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self';
set X-Content-Type-Options: nosniff
set Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self';,
set X-Content-Type-Options: nosniff,
set X-Frame-Options: DENY
</param-value>
</init-param>