'How to add content security policy on react app
How to add security layer that with meta tags to my react application correctly, I have tried to do it with the npm csp-html-webpack-plugin but I get as a result that the app is not displayed in the browser and a list of errors by content security policy violation
most of the errors have to do with style-src since I am using the material UI package
And others with read property 'cssRules' of null
I am using pm2 to launch my application
my build looks like this
"build": "env-cmd -e production react-app-rewired build"
my meta header looks like this
<meta http-equiv="Content-Security-Policy" content="" />
my config-overrides.js looks like this
const { override } = require("customize-cra");
const cspHtmlWebpackPlugin = require("csp-html-webpack-plugin");
const cspConfigPolicy = {
"style-src": ["'self'", "'unsafe-inline'"],
"default-src": ["'self'"],
"base-uri": "'self'",
"object-src": "'none'",
"script-src": ["'unsafe-inline'", "'https://unpkg.com'"]
};
function addCspHtmlWebpackPlugin(config) {
if (process.env.NODE_ENV === "production") {
config.plugins.push(new cspHtmlWebpackPlugin(cspConfigPolicy));
}
return config;
}
module.exports = {
webpack: override(addCspHtmlWebpackPlugin)
};
and my .env look like this
"production": {
"GENERATE_SOURCEMAP": false,
"INLINE_RUNTIME_CHUNK": false,
"REACT_APP_PUBLIC_URL": "",
"REACT_APP_API_URL": "localhost",
"REACT_APP_API_VERSION": "api/v1",
}
Could someone show an example of how to do it please
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
