Content Security Policy - setup a Nonce

[jovana]

Hi, Using this integration but I noticed it is not possible to set a nonce to be compliant on the CSP policies.
Is there any way to set the nonce to the inline style?

<PopupButton 
   nonce="CODE"
   // other config ...
/>

More info: https://content-security-policy.com/examples/allow-inline-style/

[tcampb]

Hey @jovana, it doesn't look like the rollup plugin we use to inject the styles supports adding a nonce:

egoist/rollup-plugin-postcss#424

Is there a build tool that you use that supports this feature? If so, I can take a look at changing the build process.

[jovana]

Hey @jovana, it doesn't look like the rollup plugin we use to inject the styles supports adding a nonce:

egoist/rollup-plugin-postcss#424

Is there a build tool that you use that supports this feature? If so, I can take a look at changing the build process.

Hi,

Thanks for your reply. No not using some kind of tool for this. Try to have libraries where is support is out of the box.
The problem is there are a lot of issues running CSP fully locked down using ReactJS. So right now I have to run the app using style-src 'self' 'unsafe-inline'

It's fine for now, but in the future, it's nice to have we can set a nonce also.

If you want you can close this issue.