[AssetMapper] Adding CSP details, recommending script-src 'strict-dynamic'
#21356
Conversation
…ynamic'` Page: https://symfony.com/doc/6.4/frontend/asset_mapper.html#handling-css I think there should be a clear recommendation for people using a Content-Security-Policy. Is `script-src 'strict-dynamic'` really the way to go? It's not possible for AssetMapper to just omit those empty entries, is it?
There was a problem hiding this comment.
Pull Request Overview
This PR adds important Content-Security-Policy (CSP) documentation to the AssetMapper section, specifically addressing issues that occur when using script-src 'self' with CSS imports. The change clarifies how AssetMapper handles CSS imports through empty importmap entries and provides guidance for CSP configuration.
- Explains how AssetMapper creates empty importmap entries for CSS files using
data:URLs - Documents the CSP conflict that occurs with
script-src 'self'when importing CSS files - Recommends using
script-src 'strict-dynamic'as a solution to CSP issues
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| executes the ``import`` statement, nothing additional happens. | ||
| When using a **Content-Security-Policy** with ``script-src 'self'``, this | ||
| will trigger an error because of the ``data:`` URL. You can either just | ||
| ignore the error, or lower the rule to ``script-src 'strict-dynamic'``. |
There was a problem hiding this comment.
[nitpick] The phrase 'lower the rule' is unclear and potentially confusing. Using 'strict-dynamic' is not necessarily 'lowering' security - it's a different security model. Consider rephrasing to 'change the rule to' or 'use' instead of 'lower the rule to'.
| ignore the error, or lower the rule to ``script-src 'strict-dynamic'``. | |
| ignore the error, or change the rule to ``script-src 'strict-dynamic'``. |
2 participants
Page: https://symfony.com/doc/6.4/frontend/asset_mapper.html#handling-css
I think there should be a clear recommendation for people using a Content-Security-Policy. Is
script-src 'strict-dynamic'really the way to go? It's not possible for AssetMapper to just omit those empty CSS entries, is it? Or change them to"/assets/app.css": ""?(The info is taken from symfony/symfony#58416 (comment))