Skip to content

Content-Security-Policy is not supported #14

@pavelarnost

Description

@pavelarnost

Ant Design support CSP via nonce in "csp" attribute of ConfigProvider. Textarea component uses inline style so nonce is not used and browser reports:

calculateNodeHeight.js:69 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-XXX'". Either the 'unsafe-inline' keyword, a hash ('sha256-+BQ4uy1Q8X6iksX2devUeYbbkg8ukCMGJSKXKhgEg9o='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

One possible solution would be use of <style> element with nonce instead of "style" attribute.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions