You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Today I used patch-package to patch @kindspells/astro-shield@1.3.5 for the project I'm working on.
My task
I had to implement the CSP headers for an astro web app appropriately to the predefined (and not negotiable) company policy.
Where I ran into obstacles:
I have to add https: to the script-src
I have to remove self from the script-src
Both of them seemed to be impossible with the current implementation of astro-shield:
if I add 'https:', astro-shield adds quotation marks around it, which makes the rule invalid
Checking the code it seems to me, that it tries to add some defaults to the CSP directives.
IMO the rule of quotation mark usage in CSP directives is chaotic enough, astro-shield should not complicate it further:) (I mean adding and removing quotation marks from the values the developer set in the config file).
My suggestion is to leave the developer-set values as it is to avoid any confusion and expand them only with the hash values of the resources.
Morning @danielszuk , you can take a look on this PR #79 .
It's very similar to what you did, but I kept having 'self' by default (it's possible to remove it by explicitly setting the CSP directive).
I also kept part of that "complex" logic you removed, to ensure that it gets rid of duplicates and always presents the directives in the same form (so equivalent directives should look the same).
Hi! 👋
Firstly, thanks for your work on this project! 🙂
Today I used patch-package to patch
@kindspells/astro-shield@1.3.5
for the project I'm working on.My task
I had to implement the CSP headers for an astro web app appropriately to the predefined (and not negotiable) company policy.
Where I ran into obstacles:
https:
to thescript-src
self
from thescript-src
Both of them seemed to be impossible with the current implementation of astro-shield:
My suggestions
Checking the code it seems to me, that it tries to add some defaults to the CSP directives.
IMO the rule of quotation mark usage in CSP directives is chaotic enough, astro-shield should not complicate it further:) (I mean adding and removing quotation marks from the values the developer set in the config file).
My suggestion is to leave the developer-set values as it is to avoid any confusion and expand them only with the hash values of the resources.
Here is the diff that solved my problem:
If it makes sense to you, I would like to contribute by implementing this patch fully (modify the tests and create the PR)
This issue body was partially generated by patch-package.
The text was updated successfully, but these errors were encountered: