-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[CSP] Allow nonce passed through header (to support Turbolinks/PJAX) #136
Comments
For the meta you need |
With #139 , you could |
OH, you can currently do $container->get('nelmio_security.csp_listener')->getNonce() And it's much more cleaner |
@romainneutron I don't think closing this is right. The request is not to allow reading the nonce, buit about setting it. |
Edit: moved to #321 |
Please open a new issue, don't reply in something from 2017. |
We are running a Symfony2 application with Turbolinks and want to use CSP. When we use the
csp_nonce()
method to generate a nonce, it will be different for every request. But since we use Turbolinks, navigating to other pages will just load the new HTML through AJAX and embed it in the current document. When a new page includes a<script>
or<style>
tag it will be blocked.So I was thinking about the following solution:
In
ContentSecurityPolicyListener
:Then in my HTML I set this:
And in my
app.js
I set something like this:This works, but what about security? Am I going to do something really stupid/bad?
The text was updated successfully, but these errors were encountered: