- Issue created by @gapple
- Status changed to Fixed
13 days ago 12:08am 14 June 2024
'strict-dynamic' requires a hash or nonce to authorize corresponding assets since any other sources, like 'self' or domains, are ignored once it is enabled. Enabling it in the config form is likely to only block all assets since the module doesn't compute either.
A site currently wanting to use 'strict-dynamic' would need to alter the library asset elements rendered by core (to add a nonce, or to compute hashes), so should be adding 'strict-dynamic' in their own event subscriber as well.
Remove 'strict-dynamic' from the options that can be enabled for script-src on the configuration page.
Fixed
2.0
Code