Closed
Description
At the moment if I set up a CSP limiting script-src the browser won't work and the only way to make it work (AFAIK) is to add the 'unsafe-inline' option to the CSP. Which is... unsafe :D
The reason for that is that there's an inline script in the HTML served by the browser:
<script type="text/javascript">
RubyEventStore.Browser.Elm.Main.init({
flags: {
/* ... */
}
});
</script>I think that the solution would be to:
- Provide the configuration hash (what's currently under
flags) to adataattribute on<body />for example; probably just dumped as JSON. - Move the
initinvocation to the main JS file: just add some code that looks for thedataattribute, loads the settings from there and if they're found and sound, pass them to theinitfunction.
I'm not sure if the current JS file that's used by the browser is ready for that or if that's even a good idea. But I'm quite confident that supporting a safe CSP should be handled.
And I'd be happy to do some work on that, just don't want to poke around blindly. Let me know if the path I'm suggesting is fine from your perspective and I'll try to prepare a PR.
Metadata
Metadata
Assignees
Labels
No labels