-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
No more meta http-equiv since 0.13.0 #178
Comments
Hey @GreyXor Thanks for reporting this issue. Would you be interested in investingating this issue and creating a pull request? :) |
Although my expertise with the Nuxt module is limited, I'm willing to give it a try. However, would you have any ideas or suggestions regarding the possible source of this bug? |
Yes, The biggest change that was introduced in these versions was the refactor of middlewares and headers into global and route rules. |
So I think that this issue is somehow related to the data passing to the plugin as the whole plugin has not changed at all. |
It seems that Line 183 in 0136784
JS passes objects by reference so deleting the headers there will impact all other subsequent usages of Seems the deletion is only there because of the for-loop where you don't want to handle
But IMO it's code smell and the loop should be rewritten so that it loops through the |
Thanks for this tip! I have already created a fix for that but I also looked at the CSP on SSG being generated incorrectly (there is only script src there while other headers should be set. |
There was a problem in two places:
Now it should work as expected: ![]() |
@GreyXor Could you check the 0.14.1 version? |
@Baroshem, thanks, seems better, although I have another problem but maybe related. security: {
nonce: true,
headers: {
contentSecurityPolicy: {
'style-src': [
"'self'", // fallback value for older browsers, automatically removed if `strict-dynamic` is supported.
"'nonce-{{nonce}}'",
],
'script-src': [
"'self'", // fallback value for older browsers, automatically removed if `strict-dynamic` is supported.
"'nonce-{{nonce}}'",
"'strict-dynamic'"
],
'script-src-attr': [
"'self'", // fallback value for older browsers, automatically removed if `strict-dynamic` is supported.
"'nonce-{{nonce}}'",
"'strict-dynamic'"
]
}
}
}, but {{nonce}} literaly appear in generated code <meta http-equiv="Content-Security-Policy" content="base-uri 'self'; font-src 'self' https: data:; form-action 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'self' 'nonce-{{nonce}}' 'strict-dynamic'; style-src 'self' 'nonce-{{nonce}}'; upgrade-insecure-requests ; script-src 'self' 'nonce-{{nonce}}' 'strict-dynamic' 'sha256-xJJj9w6qgxhSKMyZfS3zCVu22GSxDA9p/seYxCqfC/0=' 'sha256-+98blmkAXZ200NERYkCs+Dh/tyOjTMb5e1IBMiB/wl8='">< |
These two things were developed independently (CSP for SSG was created about two versions before) while this new noonce support was created in the last few days. @trijpstra-fourlights Would you be up for helping @GreyXor with the issue he is encountering? I would really appreciate it :) |
Sure, I'll take a look. I suspect it's because both nitro plugins hook into the same hook so and the ordering is not explicitly defined. So the nonce handler is firing before the meta-equiv is added by cspSsg. |
As seen here: https://nitro.unjs.io/guide/plugins |
Sure, that should be possible. I've looked into it, and I'm pretty sure the ssgHandler will need to be made nonce-aware as well. I'll whip up a PR for this. Will let you know when it's ready. |
@GreyXor could you test with my proposed fixes? change in your package.json
and do an |
Sorry, just this in my package.json ? yarn install "devDependencies": {
"nuxt": "^3.6.3",
"nuxt-security": "github:trijpstra-fourlights/nuxt-security#build/fix/nonce-and-ssg",
} I got this :
|
It seems that the syntax I provided is for Could you try |
|
Perhaps you'll have to Running the test fixtures with |
even creating a new project doesn't work, not with pnpm nor yarn. If your nonce are visible, that solves the problem. My package pulling issue is something else, thanks ! |
Thank you @trijpstra-fourlights for the fix and implementation! And thank you @GreyXor for testing. I have tested it on my end and it seems to be working correctly on 0.14.2 :) |
Please note that it actually does not make any sense to use In SSG mode the nonce becomes static as it's generated once at build-time and thus becomes a potential attack vector for XSS. To use a strict CSP in SSG, you need to whitelist your resources using sha-256 hashes. This is what For more information see https://web.dev/strict-csp/#step-1-decide-if-you-need-a-nonce-or-hash-based-csp |
Version
Reproduction Link
Steps to reproduce
Install nuxt-security >= 0.13.0
I'm using all default and running
nuxt generate
.with version 0.12.0 it works
What is Expected?
meta http-equiv added in index.html
What is actually happening?
No meta http-equiv
The text was updated successfully, but these errors were encountered: