-
-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix CSP for script-src with nonce on edge #43778
Conversation
Alternative would be to throw away It seems like all our supported browsers support CSP nonce, if you find a browser that does not it probably will also not be able to parse our JS code. |
Makes sense, I'd still like to keep the commits here to be able to backport them to 28 and only do the full removal for master then. |
Sounds good, so just fixup the commits :) |
Signed-off-by: Julius Härtl <jus@bitgrid.net>
Signed-off-by: Julius Härtl <jus@bitgrid.net>
Signed-off-by: Julius Härtl <jus@bitgrid.net>
3da6646
to
78ba1b0
Compare
/backport to stable28 |
Hi, it should, the pull request has been merged! I did not test yet |
This fixes issues that may occur using MS Edge where the usage of a nonce for script-src was not indicated in the CSP headers.
https://learn.microsoft.com/en-us/microsoft-edge/web-platform/user-agent-guidance
Short summary for the user agent pattern,
Edg/<Version>
is the new way to detect instead ofEdge/<Version>
Checklist