Content Security Policy (CSP) without unsafe-inline scripts?

Adriaan van Os <[email protected]> Tue, 12 Jul 2022 21:12:34 +0200 (CEST)
Newsgroups	gmane.comp.lang.smalltalk.squeak.seaside
Message-ID	<[email protected]>
--===============9125866963749263336==
Content-Type: multipart/alternative; 
	boundary="----=_Part_1231566_1282536353.1657653154292"

------=_Part_1231566_1282536353.1657653154292
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit


 Hi, 



 Did anyone try to implement a Content Security Policy (CSP) <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP> without allowing unsafe-inline <https://content-security-policy.com/unsafe-inline/> scripts for a single page (jQuery AJAX) Seaside application? I made a few things working with nonce <https://content-security-policy.com/nonce/>, using a custom subclass of JQScriptGenerator and some other tweaks, but was wondering what other people are doing. 



 Cheers, 

 Adriaan. 

------=_Part_1231566_1282536353.1657653154292
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!doctype html>
<html>
 <head> 
  <meta charset="UTF-8"> 
 </head>
 <body>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   Hi,
   <br>
  </div>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   <br>
  </div>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   Did anyone try to implement a <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP">Content Security Policy (CSP)</a> without allowing <a href="https://content-security-policy.com/unsafe-inline/">unsafe-inline</a> scripts for a single page (jQuery AJAX) Seaside application? I made a few things working with <a href="https://content-security-policy.com/nonce/">nonce</a>, using a custom subclass of JQScriptGenerator and some other tweaks, but was wondering what other people are doing.
   <br>
  </div>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   <br>
  </div>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   Cheers,
   <br>
  </div>
  <div style="font-family:-apple-system,BlinkMacSystemFont,helvetica,sans-serif;" class="default-style">
   Adriaan.
   <br>
  </div>
 </body>
</html>
------=_Part_1231566_1282536353.1657653154292--

--===============9125866963749263336==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2Vhc2lkZSBt
YWlsaW5nIGxpc3QKc2Vhc2lkZUBsaXN0cy5zcXVlYWtmb3VuZGF0aW9uLm9yZwpodHRwOi8vbGlz
dHMuc3F1ZWFrZm91bmRhdGlvbi5vcmcvY2dpLWJpbi9tYWlsbWFuL2xpc3RpbmZvL3NlYXNpZGUK

--===============9125866963749263336==--