A hub and casual space for you to interact with fellow community members and learn more about Umbraco!

Umbraco

The configuration in the backoffice is very nice!
But I can't get the tag helper to work

that the more coming soon, I just need to do some more testing but wanted to get Aarons PR from October out.
If you need it I can release it as a pre-release though

That is why! 😅 
I was looking in the repo and compared what I had configured - Didn't think of checking the package version

How would I add the nonce without the tag helper?

Or... Couldn't I just copy your tag helper into my project?
I guess the CSP service would be available?

So if you had a way of generating a random nonce value there is events you can hook into to alter the CSP

https://github.com/Matthew-Wise/Umbraco-CSP-manager/tree/1.2.1/src latest released source is this

CspWritingNotification lets you alter the header before it goes "out"

the challenge with nonce is it should be unquie per request. 

I have tested the nonce stuff manually but want some automatation which is why its not out yet

To save you the pain of adding nonce without Ill tag up a beta release now 🙂 (its all automated ;))

Should appear on NuGet shortly 🙂 (first time I have ever got the release pipeline first time 😄 )

https://www.nuget.org/packages/Umbraco.Community.CSPManager/1.3.0-beta

The tag helper getting registered, but it only add an empty nonce


https://cdn.discordapp.com/attachments/1225720537108578345/1225726790664978565/image.png?ex=66222e07&is=660fb907&hm=3b384411db9879e2ceb40094c8cd7f0b76408a448f0f848a507ce8ab4a863901&

'strict-dynamic' as a script source is super powerful btw  - https://content-security-policy.com/strict-dynamic/
It pretty much solves GTM 😉

Aaah okay 😄
Still getting an error though
`Refused to execute inline script because it violates the following Content Security Policy directive: "script-src-elem localhost". Either the 'unsafe-inline' keyword, a hash ('sha256-Esn7Zb7FBRDn3I4afnisr4bjWWPnNHfSUd7R1Tuxh5E='), or a nonce ('nonce-...') is required to enable inline execution.`

so any <script> Blah</script> needs a hash or nonce

So that error all depends on the script 🙂

if its something generated from GTM you probably need to update the GTM include script to support nonce, which they do provide 🙂

It was just me testing some inline stuff in a script tag

If i understand in correctly, I would need the hash added to the CSP header.
I am not really sure how I would do that when using CSP Manager

same way  'unsafe-inline'  so hash and check script-src