Commits on Aug 21, 2015

1. Remove the CSP nonce from the CSP header …

   Spec is here: http://www.w3.org/TR/CSP2/#directive-script-src
   
     "If 'unsafe-inline' is not in the list of allowed script sources, or
      if at least one nonce-source or hash-source is present in the list of
      allowed script sources:"
   
   The intention is to let sites start to lock things down with nonce
   and/or hashes while specifying unsafe-inline so CSP1.0-compliant
   browsers don't break on the site. It's a transition state.
   
   Note this means that if you use a nonce/hash it's not possible to use
   javascript: urls or inline event handlers. It's as if the policy didn't
   have unsafe-inline at all. Probably worth throwing a warning on the web
   console if we encounter both unsafe-inline and a hash/nonce. It's not an
   error, but it might be a mistake. ("warning, 'unsafe-inline' is ignored
   when hash or nonce also used")
   
   Further discussion here:
   https://bugzilla.mozilla.org/show_bug.cgi?id=1004703

   

   kjc-stripe committed Aug 21, 2015
   Configuration menu

   • View commit details
   • Copy full SHA for 02116a0
   • Browse repository at this point

   Copy the full SHA

   02116a0 View commit details

   Browse the repository at this point in the history