[Feature Request] Theme CSP nonce should be removed

[Antti-Palola]

Problem to solve

Theme cspNonce gives sense of false security. The nonce should be regenerated for every request or it is really not any more secure than unsafe-inline as the attacker could use the static nonce in their payload.

Proposed solution

The only real solutions are to either use a CSP hash or not generate a theme at all.
This should be documented so people find the correct solution.

The generated theme hash should not change between builds so it would need to be regenerated only if theme configuration changes.

[SegaraRai]

+1 for this. A nonce should not be a fixed value.

FWIW I managed to load Vuetify at build time and generate a CSP.
It appears to be working fine as of now.
https://github.com/SegaraRai/vuetify3-with-csp

[sbernard31]

Theme cspNonce gives sense of false security. The nonce should be regenerated for every request or it is really not any more secure than unsafe-inline as the attacker could use the static nonce in their payload.

⚠️ I pretty new on this topic but reading CSP nonce Guide, I also understand that ☝️ .

So, I don't think this was a good idea to have closed this issue.

I saw several users asking for help to solve unsafe-inline issue for style on vuetify discord and they are often encouraged to use the current "nonce" way.

The only real solutions are to either use a CSP hash or not generate a theme at all.
This should be documented so people find the correct solution.

The generated theme hash should not change between builds so it would need to be regenerated only if theme configuration changes.

This also makes sense to me.
For not generate a theme at all, it can be done like this : #3349 (comment) but unless I missed something when theme is deactivate the application will probably looks like expected...
For hash, it could help to have a look at Using a hash with CSP

[sbernard31]

(I add link to a related discord discussion : https://discord.com/channels/340160225338195969/1143844905660190790)

[sbernard31]

(Just in case, I ping @johnleider)