Allow usage of this library without forcing CSP `unsafe-inline` about size-sensor HOT 3 CLOSED

The second way means add style as below:

<style>
   .size-sensor-object {
     // ...
   }
</style>

then use class name instead of inline style? What the meaning of a nonce attribute?

from size-sensor.

then use class name instead of inline style? What the meaning of a nonce attribute?

It is basically a way to whitelist which scripts/styles are allowed to be executed on a page to protect against certain scripting attacks.

The nonce is a random token that is generated on the server new for every page visit.

Look for example here for a detailed explanation: https://stackoverflow.com/a/42924000

We would need a way to "inject" our nonce attribute from the document into the <style> tag that size-sensor generates. Not sure what is best practice here for other libraries, but I quite like JSS's approach, they read the value from the document's <meta> tag.

from size-sensor.

@tzimmermann can give me a pr for this? I would like to see whether it will increase the complexity of usage.

from size-sensor.