Feature: Introduce nonce
prop to ChayaProvider
for CSP compliance
#147
Labels
enhancement
New feature or request
nonce
prop to ChayaProvider
for CSP compliance
#147
Is your feature request related to a problem? Please describe.
A strict Content Security Policy (CSP) header is a crucial requirement for adhering to modern security standards. Currently, the Chaya UI injects
<script>
and<style>
tags directly into the rendered HTML. This approach necessitates relaxing the CSP rules by addingunsafe-eval
orunsafe-inline
to thescript-src-elem
andstyle-src-elem
directives. This relaxation is required for the client (browser) to correctly render the HTML, as the injected<style>
and<script>
tags lack the necessarynonce
orhash
attribute to verify the integrity.Describe the solution you'd like
Introducing a
nonce
prop to theChayaProvider
component would enable Chaya UI to become CSP compliant. This would allow developers to specify a uniquenonce
value in their CSP header and pass it down to the Chaya UI components. By incorporating thisnonce
into the generated<script>
and<style>
tags, developers can maintain a strict and secure CSP while still utilizing the Chaya UI library effectively.The text was updated successfully, but these errors were encountered: