Why SRI must not be used for page.js + how to load AddToAny with a CSP

Issue created by @paucala

@paucala opened merge request.

🇪🇸Spain paucala

Issue was unassigned.

Status changed to Closed: works as designed almost 2 years ago

🇺🇸United States micropat

Definitely do not use SRI on page.js — that evergreen file receives important updates and SRI will break it on the very next update.

For site security AddToAny supports a strict content security policy (CSP) with nonces; however, nonces aren't currently straightforward to implement in Drupal ( csp module issue ✨ Allow script / style by nonce Postponed , seckit module issue ✨ Implement a "semi automatic" Nonce settings Needs work ), so it's a good idea to explicitly allow specific domains in .htaccess like:

Header add Content-Security-Policy "default-src 'unsafe-inline' https://*.addtoany.com https://*.pinterest.com; img-src 'self' data:;"

This explicitly allows domains such as https://*.addtoany.com (and https://*.pinterest.com if Pinterest is wanted, for example).

Comments & Activities