[AssetMapper] Document how to make it work with a Content Security Policy #19865
Conversation
|
Hey! Oh no, it looks like you have made this PR towards a branch that is not maintained anymore. :/ Cheers! Carsonbot |
nicwortel
force-pushed
the
asset_mapper_csp
branch
from
ee67304 to
f117a41
Compare
|
|
||
| .. code-block:: html+twig | ||
|
|
||
| {{ importmap('app', {'nonce': csp_nonce('script')}) }} |
There was a problem hiding this comment.
The csp_nonce function is unknown because it is part of the NelmioSecurityBundle.
Should I remove it from the example and instead just refer to the documentation of the NelmioSecurityBundle?
There was a problem hiding this comment.
I think it's OK because you linked to the bundle in the previous paragraph ... but I'd add a comment in this code to explain that this function comes from that bundle:
.. code-block:: twig
{# the csp_nonce() function is defined by the NelmioSecurityBundle #}
{{ importmap('app', {'nonce': csp_nonce('script')}) }}There was a problem hiding this comment.
I added the comment 👍 however, that doesn't solve the error reported by the "Code Blocks" workflow, so the build still fails.
|
|
||
| .. code-block:: html+twig | ||
|
|
||
| {{ importmap('app', {'nonce': csp_nonce('script')}) }} |
There was a problem hiding this comment.
I think it's OK because you linked to the bundle in the previous paragraph ... but I'd add a comment in this code to explain that this function comes from that bundle:
.. code-block:: twig
{# the csp_nonce() function is defined by the NelmioSecurityBundle #}
{{ importmap('app', {'nonce': csp_nonce('script')}) }}
|
@javiereguiluz thanks, I have addressed your comments 👍 |
OskarStark
force-pushed
the
asset_mapper_csp
branch
from
92ad3c3 to
19e4f28
Compare
|
Thank you Nic. |
Last week I converted a website from classic Webpack (without Encore) to AssetMapper and so far I'm impressed with how it simplifies asset management! 🎉 (thanks @weaverryan!)
One thing I had some difficulty with was to get it working with the website's Content Security Policy. Before the switch I only used static assets hosted on the same domain, but the importmap functionality relies on inline scripts - which are blocked by default when a CSP is configured.
I managed to get it working using a nonce, with the help of NelmioSecurityBundle. The nonce is inserted into the
<script>tags by passing it to the second argument of theimportmap()function. This functionality was introduced in Symfony 6.3 by symfony/symfony#50456 for this exact use case, but has not been documented as far as I could find.