René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Support for Content-Security-Policy using HASH (sha-256)","articleBody":"### Which @angular/* package(s) are relevant/related to the feature request?\r\n\r\n@angular/core\r\n\r\n### Description\r\n\r\nHi. I was trying to implement the HASH approach (CSP level 2) without success.\r\n\r\nThe main problem is that when the Angular app is loaded, all styles are added inline to the index.html HEAD.\r\nSince the styles have IDs (this Angular self-generated one) in the CSS code, I'd need to generate the hash after this CSS changed but my Content-Security-Policy header already came from the API that is generating it.\r\nExternal docs: https://content-security-policy.com/hash\r\n\r\nI haven't found anything related in the official docs. I only found info related to the 'nonce' approach. \r\nAngular official doc related: https://angular.dev/best-practices/security#content-security-policy \r\nExternal docs: https://content-security-policy.com/nonce/\r\n\r\nAre you working already on a solution?\r\n\r\n### Proposed solution\r\n\r\nAdd support for this feature (like the 'nonce' one).\r\n\r\n### Alternatives considered\r\n\r\nLet Angular handle generating the hashes for all scripts and styles at compile time.","author":{"url":"https://github.com/jlfrances","@type":"Person","name":"jlfrances"},"datePublished":"2024-05-30T11:29:49.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/56181/angular/issues/56181"}