- Issue created by @gapple
- Status changed to Fixed
10 months ago 12:08am 14 June 2024 Automatically closed - issue fixed for 2 weeks with no activity.
'strict-dynamic' requires a hash or nonce to authorize corresponding assets since any other sources, like 'self' or domains, are ignored once it is enabled. Enabling it in the config form is likely to only block all assets since the module doesn't compute either.
A site currently wanting to use 'strict-dynamic' would need to alter the library asset elements rendered by core (to add a nonce, or to compute hashes), so should be adding 'strict-dynamic' in their own event subscriber as well.
Remove 'strict-dynamic' from the options that can be enabled for script-src on the configuration page.
Fixed
2.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.