[ https://issues.apache.org/jira/browse/MYFACES-4280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16887916#comment-16887916 ]
Werner Punz commented on MYFACES-4280: -------------------------------------- I am in contact with thomas, closing it until I get an example. Cannot reproduce it for the time being. > CSP: nonce attribute on script tags will be ignored on ajax updates > ------------------------------------------------------------------- > > Key: MYFACES-4280 > URL: https://issues.apache.org/jira/browse/MYFACES-4280 > Project: MyFaces Core > Issue Type: New Feature > Reporter: Thomas Andraschko > Assignee: Werner Punz > Priority: Major > > simple CSP case: > - add a static nonce via phaselistener/servlerfilter in the headers > - add the the static nonce to a script tag > this works fine for a GET request or non-ajax POST but our ajax engine just > ignores the nonce attribute on scripts and following error occurs in the > browser: > Content Security Policy: Die Einstellungen der Seite haben das Laden einer > Ressource auf inline blockiert ("script-src"). > There will probably other tickets in the future but thats the first basic > case which must be supported. > There are of course other problems like onclick handlers in the DOM or the > eval node in the partial-response. > Similar to: https://github.com/jquery/jquery/issues/3541 -- This message was sent by Atlassian JIRA (v7.6.14#76016)