-
Notifications
You must be signed in to change notification settings - Fork 10.4k
Labels
Priority:1Work that is critical for the release, but we could probably ship withoutWork that is critical for the release, but we could probably ship withoutarea-blazorIncludes: Blazor, Razor ComponentsIncludes: Blazor, Razor Components
Milestone
Description
Is there an existing issue for this?
- I have searched the existing issues
Is your feature request related to a problem? Please describe the problem.
blazor.server.js creates sometimes inline styles dynamically at runtime. This is a violation of strict Css CSP Policies. Workarounds with JS CreateElement and analogous tricks is unsafe itself, because it defeats the purpose of CSP by creating a bypass mechanism and is vulnerable to being overwritten by XSS attacks.
Describe the solution you'd like
The framework itself should provide a possibility (flag,option,...) to create CSP nonces for by the framework generated inline styles.
Additional context
No response
MrCliff, damienbod, garrettlondon1, justinasmussen, dimodi and 3 more
Metadata
Metadata
Assignees
Labels
Priority:1Work that is critical for the release, but we could probably ship withoutWork that is critical for the release, but we could probably ship withoutarea-blazorIncludes: Blazor, Razor ComponentsIncludes: Blazor, Razor Components