Skip to content

Remove 'unsafe-inline' from the CSP#5844

Merged
jmhooper merged 2 commits intomainfrom
jmhooper-remove-unsafe-inline
Jan 21, 2022
Merged

Remove 'unsafe-inline' from the CSP#5844
jmhooper merged 2 commits intomainfrom
jmhooper-remove-unsafe-inline

Conversation

@jmhooper
Copy link
Contributor

Why: It was added to provide backwards compatibility for browsers that don't support nonces in the CSP. That browser share has shrunk over the years to the point where it should be safe to close this gap in our CSP.

**Why**: It was added to provide backwards compatibility for browsers that don't support nonces in the CSP. That browser share has shrunk over the years to the point where it should be safe to close this gap in our CSP.
@jmhooper
Copy link
Contributor Author

This is a companion to #5757. This change is significant enough to warrant it's own PR and will help reduce diff noise on the other PR.

Copy link
Contributor

@zachmargolis zachmargolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jmhooper jmhooper merged commit 17365ab into main Jan 21, 2022
@jmhooper jmhooper deleted the jmhooper-remove-unsafe-inline branch January 21, 2022 18:58
@aduth
Copy link
Contributor

aduth commented Jan 24, 2022

Looks like the user mailer preview feature enabled in #5502 doesn't look quite as nice after these changes.

https://idp.dev.identitysandbox.gov/rails/mailers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants