Closed
Description
Command
build
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
I want to implement strict CSP policy for my project, so replaced unsafe-eval and unsafe-inline with nonce-dynamicnonce.
But Angular version 18.1.1 is not adding nonce to script tags of main.js, polyfills.js etc.
Because of that it is considering this scripts tags as unsafe and browser is blocking its execution.
In below stackblitz I used 18.1.1 and added nonce using CSP_NONCE and ngCspNonce. But it is not adding nonce to script tags. Please inspect and check in Dom.
Stackblitz URL: https://stackblitz.com/edit/stackblitz-starters-wr9a9h?file=src%2Fapp%2Fapp.config.ts
As per below merged Issue, It should work in 18.1.1. But it is not working.
#27875
Kindly check!!
Thanks in advanced!
Minimal Reproduction
- apply nonce using ngCspNonce and CSP_NONCE provider
- using dev tools check script tags in DOM.
- It is not adding nonce to script tags of main.js,polyfills.js etc..
Exception or Error
No response
Your Environment
18.1.1
Anything else relevant?
No response