-
Notifications
You must be signed in to change notification settings - Fork 1
Description
Is your feature request related to a problem? Please describe.
A strict Content Security Policy (CSP) header is a crucial requirement for adhering to modern security standards. Currently, the Chaya UI injects <script>
and <style>
tags directly into the rendered HTML. This approach necessitates relaxing the CSP rules by adding unsafe-eval
or unsafe-inline
to the script-src-elem
and style-src-elem
directives. This relaxation is required for the client (browser) to correctly render the HTML, as the injected <style>
and <script>
tags lack the necessary nonce
or hash
attribute to verify the integrity.
Describe the solution you'd like
Introducing a nonce
prop to the ChayaProvider
component would enable Chaya UI to become CSP compliant. This would allow developers to specify a unique nonce
value in their CSP header and pass it down to the Chaya UI components. By incorporating this nonce
into the generated <script>
and <style>
tags, developers can maintain a strict and secure CSP while still utilizing the Chaya UI library effectively.