feat: Use CSP for scripts with (cached) nonce + strict-dynamic #61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
Commits
|
mokimo
approved these changes
Mar 13, 2025
There was a problem hiding this comment.
Could you also clear the cache for these 2 files, please? Looking at https://strictdynamic--blog--adobecom.aem.page/, I don't see the changes applied. Am I missing something?
Nevermind, cache has been cleared now.
overmyheadandbody
approved these changes
Mar 13, 2025
hit11757
approved these changes
Mar 18, 2025
There was a problem hiding this comment.
Validated. Test details https://jira.corp.adobe.com/browse/MWPW-169753
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ticket https://jira.corp.adobe.com/browse/MWPW-169753
Test URL:
For more details on the CSP, please checkout:
If you would prefer to use the headers config, rather than putting the meta tag in code, that is supported too. I used this mechanism because it allows testing on a branch, without impacting anything else. The
nonce="aem"on the script tags however needs to be preserved in code.From the quick tests I did by clicking around the blog, I didn't see any CSP violation error.
I see either the same errors from the
stagebranch or CORS errors from IMS, which should be unrelated.