[FR] CSP nonce support

[nystudio107]

[FR] CSP nonce support

[khalwat]

@tomkiss I'm slightly confused, there is no license for Twigpack, it's free?

[khalwat]

So there's no nonce support currently, but I would be open to adding it if you like.

PRs are welcome too.

[khalwat]

@tomkiss Where would the value in nonce="" come from? Would it be a constant you pass in, or would it be from the webpack generated hash or...?

[tomkiss]

Hi, sorry for the delayed response.

The nonce itself is unique for each request, so wouldn't be part of the build process. I've less experience of nonces on PHP projects and more from React - but I notice that there is a Craft plugin that supports nonces for CSP out there, at least as one implementation example:
https://plugins.craftcms.com/content-security-policy

*RE: "buying a license", lol - I went on a bit of a license-buying rampage and lost track a bit. Aforementioned baby-brain something to do with the confusion perhaps :)

[khalwat]

So I look a look at the spec: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

A whitelist for specific inline scripts using a cryptographic nonce (number used once). The server must generate a unique nonce value each time it transmits a policy. It is critical to provide an unguessable nonce, as bypassing a resource’s policy is otherwise trivial. See unsafe inline script for an example. Specifying nonce makes a modern browser ignore 'unsafe-inline' which could still be set for older browsers without nonce support.

The plugin you referenced does it thusly:

https://github.com/born05/craft-csp/blob/master/src/services/Headers.php#L125

It's not clear to me that this is unguessable, but if the random seed is isn't deterministic, I guess it'd be okay.

The rub here is that based on what I read, any nonces that are used in the script/style tags then also appear to need to be sent as part of the header as well.

It seems that to do this right, I'd need to send headers as well as applying the nonce to the script/style tags. Or were you envisioning handling that part yourself?

[khalwat]

@tomkiss okay I added support for cspNonce in 66a566c

You can set your semVer to dev-develop and do a composer update to pull it down and give it a whirl.

I have not fully tested the implementation yet, so feedback would be great!

[khalwat]

Added in 1.2.2: https://github.com/nystudio107/craft-twigpack/releases/tag/1.2.2