Skip to content

'nonce' attribute of <mini-profiler /> taghelper does not work for stylesheet include #560

@d-gibbs

Description

@d-gibbs

I'm using MiniProfiler.AspNetCore.Mvc v4.2.1 and attempting to set a nonce on the tag helper like so:

<mini-profiler nonce="@Html.CspScriptNonce()" />

I'm finding that the nonce is correctly being set on the <script /> includes file (trimmed):

<script async id="mini-profiler" src="/mini-profiler-resources/includes.min.js?v=4.2.1+b27bea37e9" data-version="4.2.1+b27bea37e9" data-path="/mini-profiler-resources/" data-authorized="true" nonce="YkvcvTp1dLG5AR1UaZvrOO0c"></script>

But not for the stylesheet:

<link rel="stylesheet" type="text/css" href="/mini-profiler-resources/includes.min.css?v=4.2.1+b27bea37e9">

Which then results in a bunch of CSP violations:

image

image

Is there a way that we can ensure the nonce gets applied to the MiniProfiler stylesheet include? At the moment it seems like the only option is to enable unsafe-inline for style-src which is not desireable.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions