Content Security Policy and SPAs
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- angular, typescript
- Domain
- build-system, security
Research direction
Start with the Angular CLI build pipeline and inspect how bootstrap JavaScript and index.html are handled. Define the output format for hashes.json and verify that it lists hashes for all bootstrap scripts so a backend can use them in its CSP header.
Written by the indexing model from the issue text.
Description
Which @angular/* package(s) are relevant/related to the feature request?
No response
Description
Currently CSP and SPAs don't work well together.
There is however something very simple we could do to make CSP 100% compatible with SPA.
Proposed solution
When Angular builds the app, also output a file called hashes.json. This file contains a list of hashes of all of the bootstrap js scripts. Then, in your backend, say asp.net core, you read this file and add the hashes to your CSP header.
This would be a very simple change that would make a lot of people's lives much easier.
Alternatives considered
- AutoCSP is not ideal because it uses the meta tag, not http headers.
- Setting the nonce to CSP_NONCE doesn't work with strict-dynamic.
- Setting the nonce in index.html breaks caching.
- Dominant language
- TypeScript
- Stars
- 27k
- Forks
- 11.8k
- Avg merge
- 16h 35m
- Merged PRs (30d)
- 176
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from angular/angular-cli
-
area: @angular/build gemini-triaged
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
angular/angular-cli#33955 ·
-
area: @angular/cli gemini-triaged
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
angular/angular-cli#33055 · 1 comment · 3 reactions ·
-
area: @angular/build gemini-triaged
Difficulty 4/5 3-5 days Newbie friendliness 72/100
angular/angular-cli#34137 ·
-
angular/build:library area: @angular/build gemini-triaged
angular/angular-cli#34131 · 1 assignee ·
-
angular/build:library area: @angular/build gemini-triaged
angular/angular-cli#34130 · 1 assignee ·
All issues in angular/angular-cli
Similar issues
-
Browser Waiting for: Product Owner
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
getsentry/sentry-javascript#24577 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
agilepathway/label-checker#640 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
agentic-workflows
Difficulty 1/5 Under an hour Newbie friendliness 85/100
githubnext/rig#534 ·
-
automation missing-model model-sync provider:pioneer
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
anomalyco/models.dev#7701 ·