#136·eva-icons

Conflicts with CSP 'nonce' policy

Author: hazeebawanCreated Jun 26, 2024Updated Jun 26, 2024

Eva uses Isomorphic-style-loader to load animation styles into the document. If site has a CSP policy of style-src: 'nonce-xyz', it prevents the eva styles from getting loaded.

Both angular and webpack provide ways to use nonce with the inline styles they append:

webpack: https://webpack.js.org/loaders/style-loader/#nonce angular: https://angular.dev/best-practices/security#content-security-policy

We can utilize either of these mechanisms and develop an approach to resolve this conflict.

Want to hear what community thinks of this?