8000 Missing CSP directives · Issue #96 · oban-bg/oban_web · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Missing CSP directives #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
sorentwo opened this issue Jun 21, 2024 · 3 comments
Closed

Missing CSP directives #96

sorentwo opened this issue Jun 21, 2024 · 3 comments
Labels
kind:bug Something isn't working
Milestone
v2.11

Comments

@sorentwo
Copy link
Member
sorentwo commented Jun 21, 2024 •
edited
Loading

The plug I am using to generate the nonce is PlugContentSecurityPolicy and the Oban Dashboard is configured to use the nonce via the csp_nonce_assign_key parameter.

https://gist.github.com/lolo-frank/f09289b0b2e70968fc5dd26179a5542c

When the dashboard is loaded with those settings, the only CSP error I haven't been able to resolve is:

Content-Security-Policy: The page’s settings blocked an inline style (style-src-attr) from being applied because it violates the following directive: “style-src 'nonce-Ltl0dBiQ25iOZ0han7gV8x723Mf2j0FZcWb7Z1e1Zq0' 'self'”

The nonce is set, but the error persists, I've included a screenshot of the FF dev tools below.

Is this a bug or a configuration issue on my end?
@sorentwo sorentwo added the kind:bug Something isn't working label Jun 21, 2024
@sorentwo sorentwo added this to the v2.11 milestone Jun 21, 2024
@fastjames
Copy link
Contributor
fastjames commented Apr 9, 2025 •
edited
Loading

I think this issue is mostly solved, but I did find a few remaining inline styles. I opened a PR to replace them with classes here:

#117

@sorentwo
Copy link
Member Author
sorentwo commented Apr 9, 2025

@fastjames Is there anything else remaining now that those inline styles were removed?

@sorentwo
Copy link
Member Author

Closing this under the assumption that last set of style changes closed it out. We'll track any other issues separately.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind:bug Something isn't working
Projects
None yet
Milestone
v2.11
Development

No branches or pull requests
2 participants
@fastjames @sorentwo
0