add cspNonce option to add a nonce attribute to the <script>

[eturino]

for CSP compliance options.

This will allow using strict CSP in development using script-dynamic and a nonce.

[eturino]

@rwjblue could you have a look, please? :)

[rwjblue]

Hmm, I'm not sure about this. A nonce is supposed to be regenerated with each request but this implementation uses a single static nonce (AFAICT).

Wouldn't a hash be a better solution? I think we can easily compute the hash to include based on the content we actually send...

@sandstrom (sorry to pester), do you have thoughts on this?

[sandstrom]

@eturino @rwjblue I see two alternatives here:

1. Solve this only for development. In that case, the solution could live here.
2. Solve this in ember-cli-content-security-policy. In that case, we need to consider minification, which will alter the script.

I think the second alternative is much better! (but it's slightly more complicated)

More details here: rwjblue/ember-cli-content-security-policy#67

---

I also agree with @rwjblue that a static nonce is a bad idea. The standard is pretty clear on using a dynamic nonce (generated for each http request).

[eturino]

I intended this only for development, to be honest. To be honest, I have no experience building addons, so I have no idea if we could make this environment dependent.

if (environment === 'development') { // is <-- possible?
  process.env.EMBER_CLI_INJECT_LIVE_RELOAD_CSP_NONCE = options.developmentCSPNonce;
}

[sandstrom]

For your own fork the code in this PR works well, so feel free to use it for local development!

However, due to the aforementioned reasons (my and rwjblues comments) I'm not sure it's a good idea to merge this PR in its current state, even if the code was restricted to development only (like you suggest).

[eturino]

fair enough :)

[sandstrom]

@eturino I still agree with you that CSP nonce support would be great (I want it myself), but I think it's better to make something that'll work for both production and development.

For that, rwjblue/ember-cli-content-security-policy#67 is probably a good way to start. If you want to dig in I'm happy to provide some pointers on where to start! 😄