Make autoCSP configurable
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- angular, typescript
- Domain
- build-system, security
Research direction
Start with the CLI build command and the existing autoCSP generation path. Trace how the generated Content-Security-Policy is assembled, then verify that the requested directives can be configured and that the resulting policy works with the stated nginx and PWA cases.
Written by the indexing model from the issue text.
Description
Command
build
Description
Great to see autoCSP property cause looks like it's the only way to go with PWA.
Please could you make possible to add extra options to generated CSP ? I'd love to specify for example default-src, img-src e.t.c.
Describe the solution you'd like
Make it somehow configurable:
"autoCsp": {
"default-src": "'self'",
"img-src": "* data: blob:",
"media-src": "'self' data:"
}
Describe alternatives you've considered
A header still will be needed for frame-ancestors to add (for example in nginx):
add_header Content-Security-Policy "frame-ancestors 'none'";
It works nicely in conjuction with autoCSP and I can even specify
add_header Content-Security-Policy "frame-ancestors 'none'; media-src 'self' data:";
The issue here is that if I add default-src
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; media-src 'self' data:";
Angular app will be broken because the least permissive policy (this one) wins.
To workaround it I will have to specify each case separately here worker-src; frame-src e.t.c but do not specify script-src which will make it enormous and hard to maintain.
I would love to specify them in index.html directly
- Dominant language
- TypeScript
- Stars
- 27k
- Forks
- 11.8k
- Avg merge
- 16h 35m
- Merged PRs (30d)
- 176
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from angular/angular-cli
-
area: @angular/build gemini-triaged
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
angular/angular-cli#33955 ·
-
area: @angular/cli gemini-triaged
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
angular/angular-cli#33055 · 1 comment · 3 reactions ·
-
area: @angular/build gemini-triaged
Difficulty 4/5 3-5 days Newbie friendliness 72/100
angular/angular-cli#34137 ·
-
angular/build:library area: @angular/build gemini-triaged
angular/angular-cli#34131 · 1 assignee ·
-
angular/build:library area: @angular/build gemini-triaged
angular/angular-cli#34130 · 1 assignee ·
All issues in angular/angular-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
ontola/atomic-server#1625 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
melgarafael/DeskcommCRM#1451 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
bug via-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bot:ai-assisted component:compact-js status:untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
midnightntwrk/midnight-sdk#403 ·