[AssetMapper] Fix unable to use asset mapper with CSP #50456
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7c49bf1 to
ccdfa22
Compare
ccdfa22 to
0a0a2c9
Compare
nicolas-grekas
approved these changes
May 29, 2023
weaverryan
approved these changes
May 29, 2023
|
Thank you @vtsykun. |
Merged
OskarStark
added a commit
to symfony/symfony-docs
that referenced
this pull request
May 7, 2024
…t Security Policy (nicwortel) This PR was squashed before being merged into the 6.4 branch. Discussion ---------- [AssetMapper] Document how to make it work with a Content Security Policy Last week I converted a website from classic Webpack (without Encore) to AssetMapper and so far I'm impressed with how it simplifies asset management! 🎉 (thanks `@weaverryan`!) One thing I had some difficulty with was to get it working with the website's [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). Before the switch I only used static assets hosted on the same domain, but the importmap functionality relies on inline scripts - which are blocked by default when a CSP is configured. I managed to get it working using a nonce, with the help of [NelmioSecurityBundle](https://symfony.com/bundles/NelmioSecurityBundle/current/index.html#nonce-for-inline-script-handling). The nonce is inserted into the `<script>` tags by passing it to the second argument of the `importmap()` function. This functionality was introduced in Symfony 6.3 by symfony/symfony#50456 for this exact use case, but has not been documented as far as I could find. Commits ------- 19e4f28 [AssetMapper] Document how to make it work with a Content Security Policy
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently not possible to use AssetMapper with dynamic
nonceattribute when a Content Security Policy is enabled (unsafe-inlinerestricted)This PR allow to pass
nonceattr to script tag. Example usage{{ importmap('app', {'nonce': csp_nonce('script')}) }}