Add ability to skip nonce generation #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

freekmurze merged 1 commit into spatie:main from juliangums:main

Dec 30, 2024

Contributor

juliangums commented Dec 24, 2024

This PR adds the ability to skip nonce generation when using unsafe-inline in your CSP policy. This is implemented by:

Adding nonce_enabled config option (defaults to true)
Updating Policy class to skip adding nonces when disabled
Adding documentation about use cases and security implications

This is particularly useful when:

Using unsafe-inline for legacy code compatibility
Working with third-party scripts that don't support nonces
Debugging CSP issues

Note: Disabling nonces in favor of unsafe-inline reduces security. Only use when necessary.


          Add ability to skip nonce generation

7c7db2e

freekmurze merged commit d03ade0 into spatie:main

10 of 28 checks passed

Member

freekmurze commented Dec 30, 2024

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet