improve CSP compliance

[vejja]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

These changes disable the possibility for the server to use a pre-determined nonce.

With these changes, the module now adheres to the W3C specs on CSP para 7.1: Nonce Reuse (https://www.w3.org/TR/CSP3/#security-nonces).

The modifications to the code include:

• disallowing the ability to set nonces on the server via cookie
• disallowing the possiblity to set nonces other than through cryptographically secure methods
• suppressing the former 'check' mode
• not sending nonces via cookie to the frontend

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
nuxt-security	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 26, 2023 6:55pm

[Baroshem]

Hey @vejja

Could you please also update the documentation of the module to be up to date with this change/fix? :)

[vejja]

Hi @Baroshem
I'm pushing a very minor change, otherwise the doc seems to be fine by me.

The only thing I'm unsure about, is our example about how to use nonce with <NuxtImg>.
According to my tests, if we use this feature, we will have

• a nonce attribute in the <img> element. As trijpstra-fourlights noted correctly, <img> is not nonceable so this is useless
• two identical nonce attributes in the <link preload> element (if the preload option is used on <NuxtImg>). The first one is inserted by NuxtImg, and the second one by ourselves. So it is not required there either.

I can reach out to the people at NuxtImg to understand why they introduced this option in the first place if you think it is useful, but for now I think we can leave the section unchanged in our docs, as the above situation does not create any practical issue.
In the longer term I suspect we could delete the section altogether, as users of nuxt-security probably don't need to use the nonce option when using <NuxtImg>.

[vejja]

Background for this last commit:

CI seemingly fails at random times on the vitest nonce tests.
The issue arises in tests because when we extract the value of the nonce to compare against expected value, it can sometimes contain the characters + or /, which are special regex characters. When we then use a string.match() against this value, we therefore need to backslash-escape the regex.
The escape function is taken from https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping

Note: this test suite regression was introduced by the use of crypto.randomBytes(16) in ee366c7 in place of crypto.randomUUID(), which only generated alpha-numerical characters.