[feature request] support SRI (sub resources integrity) about dark-mode-toggle HOT 6 CLOSED

There's just one file in dist/. Your build process would need to calculate a nonce, and then you should be good. Unless I misunderstand the problem.

from dark-mode-toggle.

Following these instructions.

from dark-mode-toggle.

There's just one file in dist/. Your build process would need to calculate a nonce, and then you should be good. Unless I misunderstand the problem.

No I believe styles won't be properly applied even if the script itself has SRI on it.

See https://dark-mode-toggle.pages.dev for an example.

from dark-mode-toggle.

Can't you fix it based on the error message:

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-MYtDEqQW7CEY24srrOR0927vm2J5OErQMkkZQmFa0yU='), or a nonce ('nonce-...') is required to enable inline execution.

from dark-mode-toggle.

Can't you fix it based on the error message:

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-MYtDEqQW7CEY24srrOR0927vm2J5OErQMkkZQmFa0yU='), or a nonce ('nonce-...') is required to enable inline execution.

It requires the hash/nonce to be added to CSP header in each response, posing a significant difficulty for those who are using static hosting services that can only change the headers configuration during deployment time.

from dark-mode-toggle.

See these tips. It may still be a bit painful, but that's just in the matter of things.

from dark-mode-toggle.