DEV Community 👩‍💻👨‍💻

A. Rdz
A. Rdz

Posted on

CSP (with A+ in mozilla observatory) + Angular2+


Has anyone gotten to publish an angular 2+ project and csp (with A + in mozilla observatory), without using the unsafe-inline alternative?

I'm trying to use the nonce alternative, but I have some doubts about it ...

  1. Whose responsibility is it to generate the value of a nonce, client or server?

  2. Any web server that you recommend for this case? (Currently the policy is being implemented in a lambda function of AWS from a cloud front)

  3. Some way to inject or pass the nonce value to the client into the index.html to later read it from angular?. (by metatag, I think)

Thanks for your attention.

Top comments (0)

🌚 Friends don't let friends browse without dark mode.

Sorry, it's true.