Skip to content

Conversation

@juliusknorr
Copy link
Member

@juliusknorr juliusknorr commented Feb 23, 2024

This fixes issues that may occur using MS Edge where the usage of a nonce for script-src was not indicated in the CSP headers.

https://learn.microsoft.com/en-us/microsoft-edge/web-platform/user-agent-guidance

Short summary for the user agent pattern, Edg/<Version> is the new way to detect instead of Edge/<Version>

  • fix: Adjust user agent pattern for Edge
  • fix: Add edge as supported user agent for CSPv3 nonces
  • fix: Allow nonce in csp header also if no other reasons are given

Checklist

@susnux
Copy link
Contributor

susnux commented Feb 23, 2024

Alternative would be to throw away browserSupportsCspV3 and instead always use the nonce #10207

It seems like all our supported browsers support CSP nonce, if you find a browser that does not it probably will also not be able to parse our JS code.

@juliusknorr
Copy link
Member Author

Makes sense, I'd still like to keep the commits here to be able to backport them to 28 and only do the full removal for master then.

@susnux
Copy link
Contributor

susnux commented Mar 8, 2024

Makes sense, I'd still like to keep the commits here to be able to backport them to 28 and only do the full removal for master then.

Sounds good, so just fixup the commits :)

@juliusknorr juliusknorr merged commit 9522ef8 into master Mar 8, 2024
@juliusknorr juliusknorr deleted the fix/edge-csp branch March 8, 2024 13:51
@juliusknorr
Copy link
Member Author

/backport to stable28

@Orchal
Copy link

Orchal commented Mar 28, 2024

Hi, it should, the pull request has been merged! I did not test yet

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Waiting for reviews bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants