Site breaks in Chrome/Edge when `require-trusted-types-for` is enabled in CSP header about sharry HOT 3 OPEN

Thanks for the report! I'm not sure I understand the issue correctly: who is putting this value into the headers? Sharry doesn't do this afaict, right? So even if Firefox supports this csp directive in the future - it does it only when it's present?

This js file is generated from Elm, so there is not much we can do 🤷🏼. Then I see a base64.js file being loaded - this doesn't happen on my installation as well?

from sharry.

who is putting this value into the headers? Sharry doesn't do this afaict, right?

Correct, I added this directive to the CSP header on all our sites, via the nginx conf file in this case, in response to a security audit. I understand this directive is still considered “experimental” so I will just roll it back for now, but it will probably become part of JS best practice before too long.

Anyway, sounds like this is may be a limitation of the Elm compiler for the time being?

Regarding the base64.js file, here’s where it’s coming from:

from sharry.

Ah I see, thanks for clarification! Yes, I think for the sharry-app.js this must be somehow addressed by Elm, this file is the product of compiling the elm source files. Let's see, perhaps there will be a new release when this directive becomes more widespread.

Thanks also for showing the base64.js - I totally forgot the dependencies from tus.js here.

from sharry.