Any form of CSP will break the admin plugin

[laurensvanochten]

When deploying CSP in the HTTP headers through the .htaccess file it will break the admin plugin, even with 'unsafe-eval' enabled. Unsure what the exact root cause is. From the firebug console it seems the CSP policy is blocking the loading of a resource based on the script-src policy, which unless the admin plugin requires external scripts should be fine (doesn't seem that the admin plugin actually calls an external script as far as I can judge).

# CSP Apache Header set Content-Security-Policy "default-src 'self' http://www.google-analytics.com https://stats.g.doubleclick.net https://maxcdn.bootstrapcdn.com/; script-src 'self' 'unsafe-eval' https://ajax.googleapis.com www.google-analytics.com; style-src 'self' https://maxcdn.bootstrapcdn.com; media-src 'self';"

[rhukster]

Did you look at the new session options? Maybe they will help with this?

https://github.com/getgrav/grav/blob/develop/system/config/system.yaml#L115-L116

[kyodev]

I'm new with Grav. I started easily but now, when I want to optimize, I can not use anymore this plugin with CSP.
In Google Chrome console, I see clearly that the problem is 2 inline scripts. For security reasons, inline scripts are unsafe. I can't solve that with htaccess only for the admin plugin.
My .htaccess:

<IfModule mod_headers.c>
Header set Content-Security-Policy: "script-src 'self' https://*.fontawesome.com; report-uri /csp-report.php"
</IfModule>

Ideally, I you can externalize the javascript

<script src="/user/plugins/admin/themes/grav/js/acript.js" type="text/javascript">

it would be great,
I've changed a troublesome script but for your plugin, I don't know how build a external javascript file with twig.
You can also send, with php, a header like

//horrible but urgently workaround
header("Content-Security-Policy : default-src 'self' 'unsafe-inline';");
//or better with a nonce declaration
header("Content-Security-Policy : default-src 'self' 'nonce-cf22c45833a1453b77429cd9e63993da';");
// with script declaration:
<script nonce=cf22c45833a1453b77429cd9e63993da>

A good introduction: www.html5rocks.com content-security-policy