Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore/2.0.0 #492

Merged
merged 33 commits into from
Sep 19, 2024
Merged
Changes from 1 commit
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
ff0ecfe
feat(csp): support style nonce in development
dargmuesli Jun 12, 2024
fad91ee
Update from useScript to Nuxt Scripts
vejja Jul 1, 2024
338be11
feat-#487: local dev with nuxt devtools
Baroshem Jul 2, 2024
b7701f1
Merge pull request #475 from dargmuesli/feat/csp/vite
Baroshem Jul 16, 2024
88dbb4c
Merge pull request #488 from Baroshem/feat/#487
Baroshem Jul 16, 2024
2d0ae0a
Merge pull request #485 from Baroshem/vejja-patch-3
Baroshem Jul 16, 2024
4528880
fix: ensure RegExp[] origin can be passed to appSecurityOptions
Shana-AE Jul 22, 2024
765d7e1
Merge pull request #498 from Shana-AE/fix/regexp-corsHanlder.origin
Baroshem Jul 26, 2024
23af05a
test: use nullish coalescing operator
P4sca1 Jul 31, 2024
eb097d0
test: add test cases for server-only components
P4sca1 Jul 31, 2024
c38a710
fix: log warning when removing static nonce from CSP header
P4sca1 Jul 31, 2024
2b0cf0f
fix: skip nonce generation and csp header update for NuxtIsland requests
P4sca1 Jul 31, 2024
a2425ce
docs: update information about Nuxt Image
P4sca1 Jul 31, 2024
0e3ab07
chore: fix typo
P4sca1 Jul 31, 2024
7811a00
Merge pull request #503 from P4sca1/docs/image-faq
Baroshem Aug 1, 2024
b0b4a08
merge changes from #500 into #502
vejja Aug 2, 2024
57ff90b
Replace isIslandRequest util with check if nonce already exist
P4sca1 Aug 3, 2024
1a5ada9
fix: use console warn instead of useLogger
P4sca1 Aug 3, 2024
e6df1ac
Merge pull request #502 from P4sca1/main
Baroshem Aug 6, 2024
4993963
feat: bump unplugin-remove to fix sitemaps
Baroshem Aug 8, 2024
b133ed6
Revert "fix: ensure RegExp[] origin can be passed to appSecurityOptions"
Baroshem Aug 9, 2024
6d16201
fix: limit cors options to serializable types, support RegExp
P4sca1 Aug 9, 2024
2763f72
Add test cases for CORS
P4sca1 Aug 9, 2024
be68db2
Add regexp example to docs and warn about escaping dots
P4sca1 Aug 9, 2024
1f70e88
Pass origin * as is
P4sca1 Aug 9, 2024
2151b7d
Fix linting issues
P4sca1 Aug 9, 2024
6a04128
origin matching should be case insensitive
P4sca1 Aug 9, 2024
f613df5
fix: update to latest @nuxt/module-builder
ThibaultVlacich Sep 9, 2024
a359071
Merge pull request #516 from ThibaultVlacich/update-module-builder
Baroshem Sep 9, 2024
3a5e3bf
fix: augment @nuxt/schema rather than nuxt/schema
ThibaultVlacich Sep 12, 2024
0c48ec5
Merge pull request #520 from ThibaultVlacich/fix/augment-@nuxt/schema
Baroshem Sep 19, 2024
85e5c91
Merge pull request #509 from P4sca1/fix/regexp-origin
Baroshem Sep 19, 2024
4c577d1
chore: bump to 2.0.0
Baroshem Sep 19, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 5 additions & 34 deletions docs/content/1.documentation/5.advanced/2.faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -245,43 +245,14 @@ Next, you need to configure your img tag to include the `crossorigin` attribute:
ℹ Read more about it [here](https://github.com/Baroshem/nuxt-security/issues/138#issuecomment-1497883915).
::

## Using nonce with CSP for Nuxt Image
## Nuxt Image

Having securely configured images is crucial for modern web applications. Check out how to do it below:

```ts
// nuxt.config.ts

security: {
nonce: true,
headers: {
contentSecurityPolicy: {
'img-src': ["'self'", 'data:', 'https:'],
'script-src': [
"'self'", // backwards compatibility for older browsers that don't support strict-dynamic
"'nonce-{{nonce}}'",
"'strict-dynamic'"
],
'script-src-attr': ["'self'"]
}
}
}
```

And then configure `NuxtImg` like following:

```vue
<template>
<NuxtImg src="https://localhost:8000/api/image/xyz" :nonce="nonce" />
</template>

<script lang="ts" setup>
const nonce = useNonce()
</script>
```
When using `<NuxtImg>` or `<NuxtPicture>`, an inline script will be used for error handling during SSR.
This will lead to CSP issues if `unsafe-inline` is not allowed and the image fails to load.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @P4sca1
Isn’t it a bit severe ?
You could probably use ‘unsafe-hashes’ here, and the inline code is always the same so you could pre-hash it.
I do agree this is not ideal though. @harlan-zw was able to replace all inline event handlers with addEventListener in @nuxt/scripts so maybe the team at NuxtImg can use the same approach?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inline code will indeed be always the same, so using unsafe-hashes could work. Maybe we could add it by default in non strict mode or behind a feature flag in strict mode to support <NuxtImg> and <NuxtPicture>.

I calculated the hash that would be needed:

echo -n "this.setAttribute('data-error', 1)" | openssl sha256 -binary | openssl base64
bwK6T5wZVTANitXbrTsel7kl/PyCjCd/Dq5Qoz3imjM=

Using addEventListener in this case is not trivial, because the event listener would be attached in onMounted(), which is too late for some kind of errors. So some errors, e.g. when the url is invalid, could be missed.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @P4sca1
What is the issue when CSP denies execution of the error handler?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The data-error property does not get set on the image tag and the error event is never emitted.
From a user's perspective the page works fine, it just shows an unloaded image.

Using nonces for inline event handlers is not supported, so currently there is no workaround.

::alert{type="info"}
ℹ Read more about it [here](https://github.com/Baroshem/nuxt-security/issues/218#issuecomment-1736940913).
ℹ Read more about it [here](https://github.com/nuxt/image/issues/1011#issuecomment-2242761992).
::

## Issue on Firefox when using IFrame
Expand Down
Loading