Ajax form content security policy

Question

Conversation around: how to set content-security-policy header read and noted

https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work.

My question is that when I use a standard Ajax form with CSP enabled to default, I get the following upon clicking the submit button.

"Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'" Either the 'unsafe-inline' keyword, a hash ([redacted]), or a nonce ('nonce-...') is required to enable inline execution."

How can I add either a hash or a nonce to Ajax forms?

Do all Drupal 7 websites require unsafe-inline for any WYSIWYG fields to work? Is that likely to be fixable?

Answer 1

script-src 'unsafe-inline' is required by CKEditor 4 included in Drupal 8 core, so a newer WYSIWYG editor may not require it. Drupal 9 will hopefully include CKEditor 5, which will not require 'unsafe-inline'. CSP Level 3 also introduces the script-src-attr and script-src-elem directives, which can be used to allow only scripts in element attributes and not <script> elements, which will enable CKEditor 4 to work and reduce risk.

Drupal 7 also requires inline scripts be allowed for drupalSettings, though there is a patch available.

---

Hashes and nonces have some downsides and challenges

• CSP Level 2 only allows hashes on inline <script> elements, not element attributes like onclick. CSP Level 3 introduces 'unsafe-hashes' to allow hashes for attributes, but it can't really be used at this time because of a lack of browser support.
• CKEditor 4 would require a 1.5KB CSP header for all of the hashes it would require.
• Nonces are only applicable to <script> elements.
• Nonces must be regenerated on each page load, preventing the page cache or other front-end caches from being able to cache the page.