Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Introduce nonce prop to ChayaProvider for CSP compliance #147

Open
seshagiriprabhu opened this issue Dec 29, 2024 · 0 comments · May be fixed by #148
Open

Feature: Introduce nonce prop to ChayaProvider for CSP compliance #147

seshagiriprabhu opened this issue Dec 29, 2024 · 0 comments · May be fixed by #148
Assignees
Labels
enhancement New feature or request

Comments

@seshagiriprabhu
Copy link

Is your feature request related to a problem? Please describe.
A strict Content Security Policy (CSP) header is a crucial requirement for adhering to modern security standards. Currently, the Chaya UI injects <script> and <style> tags directly into the rendered HTML. This approach necessitates relaxing the CSP rules by adding unsafe-eval or unsafe-inline to the script-src-elem and style-src-elem directives. This relaxation is required for the client (browser) to correctly render the HTML, as the injected <style> and <script> tags lack the necessary nonce or hash attribute to verify the integrity.

Describe the solution you'd like
Introducing a nonce prop to the ChayaProvider component would enable Chaya UI to become CSP compliant. This would allow developers to specify a unique nonce value in their CSP header and pass it down to the Chaya UI components. By incorporating this nonce into the generated <script> and <style> tags, developers can maintain a strict and secure CSP while still utilizing the Chaya UI library effectively.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant