ember-cli-pace
ember-cli-pace copied to clipboard
vectart
Content security policy violation
This line requires inline script execution in production mode and shows error in the browser console. The error can be silenced by enabling 'unsafe-inline' to script-src in content security policy but this will make the whole application unsafe.
@musaffa I've mostly turned off CSP in my Ember apps, but do you have a good suggestion for how to handle this?
The addon may need a rewrite or nonce feature of CSP can be utilized to white list this specific script.
@musaffa do you have any interest in doing a PR for either:
- making this work with CSP?
or
- adding some docs to the README for using
nonceto whitelist?
@JoshSmith The current implementation heavily relies on inline scripting as it returns a script tag using contentFor. Using nonce is a no-go, because nonce is a random number which should be inserted in script-src on every page request. The random number has to be different on every page request. A relatively simpler option is to include SHA hash of the script itself in the script-src but it is still very complicated.
I've ended up with a much simpler manual implementation:
// application/route.js
actions: {
loading(transition) {
this._super(...arguments);
Pace.start();
transition.promise.finally(function() {
Pace.stop();
});
}
}
I've then imported pace.js in ember-cli-build.js and a pace theme in the stylesheet.
Configuration options can also be inserted into Pace like Pace.start(customConfig). Going this way may need a major rewrite of the addon.
Is there really no way in CSPs to be able to specify a particular inline script being injected like this one?
I unfortunately do not have time personally right now to put forth such a massive rewrite (and others probably would want something to say about that), but I'd be happy to see a PR if you wanted to attempt a major version bump branch.
Nonce and SHA hash are ways to do this job. But their implementations can be a bit difficult.
My custom implementation is way simpler and does the job that I need. I will need to see if the code can be extracted for the addon.
