Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Content Security Policy allow inline style without unsafe-inline

Using content security policy without style-src 'unsafe-inline' how do you allow styles like this?

<span style="font-size: 16px;">Hello</span>

I've tried adding a nonce to them and adding that nonce to the CSP header but that doesn't seem to work

<span style="font-size: 16px;" nonce="0611873de7e2db5985c289fdfa946caee2ae1860">Hello</span>

"style-src 'nonce-0611873de7e2db5985c289fdfa946caee2ae1860' 'self'"

Is there any way to do this without adding the 'unsafe-inline' directive??

like image 452
damon Avatar asked Oct 06 '15 18:10

damon


1 Answers

According to https://bugzilla.mozilla.org/show_bug.cgi?id=855326#c35 nonces for style attributes isn't supported

like image 108
damon Avatar answered Oct 14 '22 10:10

damon