Skip to content

Angular 18.1.1 is not adding CSP nonce attribute to script tags generated during build(main.ts,polyfills.js etc...) #28102

Closed
@sagartalaviya91

Description

@sagartalaviya91

Command

build

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

I want to implement strict CSP policy for my project, so replaced unsafe-eval and unsafe-inline with nonce-dynamicnonce.
But Angular version 18.1.1 is not adding nonce to script tags of main.js, polyfills.js etc.
Because of that it is considering this scripts tags as unsafe and browser is blocking its execution.
In below stackblitz I used 18.1.1 and added nonce using CSP_NONCE and ngCspNonce. But it is not adding nonce to script tags. Please inspect and check in Dom.
Stackblitz URL: https://stackblitz.com/edit/stackblitz-starters-wr9a9h?file=src%2Fapp%2Fapp.config.ts

As per below merged Issue, It should work in 18.1.1. But it is not working.
#27875

Kindly check!!
Thanks in advanced!

Minimal Reproduction

  1. apply nonce using ngCspNonce and CSP_NONCE provider
  2. using dev tools check script tags in DOM.
  3. It is not adding nonce to script tags of main.js,polyfills.js etc..

Exception or Error

No response

Your Environment

18.1.1

Anything else relevant?

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions