nuxt-security feat(csp): require-trusted-types-for

Is your feature request related to a problem? Please describe.

The module seemingly does not support the require-trusted-types-for content security policy.

Describe the solution you'd like

The policy should be added.

Describe alternatives you've considered

Not using this policy 🥲😉

Additional context

Since https://github.com/vuejs/core/pull/10844 and v3.5 Vue supports trusted types.

Sep 23 '24 02:09 dargmuesli

Hey Jonas!

Thanks for rising this issue. I checked the availability of this particular option and it seems that it is not supported by either Mozilla or Safari and I wonder if we should support as we do it with Permissions Policy or focus on the ones that are more known 🤔

Thougths @vejja?

Sep 23 '24 03:09 Baroshem

caniuse shows almost 75% global support. It's not urgent for me though! Just wanted to mention this feature request as it would come up eventually this way or another I'm sure 😁

Sep 23 '24 08:09 dargmuesli

We can support it, no problem I think

Sep 23 '24 09:09 vejja

@dargmuesli would you be interested in developing this functionality? :)

Sep 24 '24 07:09 Baroshem

I might come across this while procrastinating :wink: but if someone else goes first, I won't complain 😁

Sep 24 '24 14:09 dargmuesli

@dargmuesli it was just a simple type modification Happy to get your feedback on whether require-trusted-types-for has the right type definition. Not clear to me if the spec says that only 'script' is valid, any word, or any combination of words...

Sep 26 '24 13:09 vejja

Thanks @vejja 💚

@dargmuesli I have changed the base branch of the linked PR to 2.1.0 as I would like to plan it for the upcoming new release. Let us know if the code developed by Sebastien is what you wanted :)

Sep 27 '24 06:09 Baroshem