Dealing with CSP and things like ToolTip

[BMCwebdev]

General question for the community. How do you deal with CSPs that would like to remove unsafe inline when components like ToolTip tend to need style attribute styles? I don't see a way around it. Wondering if anyone has tackled this issue. Thanks!

[BMCwebdev]

Thinking about this, it would also include:

• Modal
• Toast
• Select
• Menu
• Radio
• Checkbox
• Popover
• Date Field
• Date Picker
• Calendar

[reidbarber]

Not my area of expertise, but this article seems helpful: https://content-security-policy.com/examples/allow-inline-style/

[BMCwebdev]

Appreciate it, thank you.

While my company may want to have a very secure CSP, I also notice other web apps/pages that have inline style attributes all over their code, and these are banks, govt sites, Paypal etc. Not my area of expertise either, but I get the feeling that many companies do not bother with it. I'll continue researching.

[reidbarber]

Yeah it seems like many don't bother with it, but if you do want to have it and use inline styles, there are ways. Here is Next.js solution for this: https://nextjs.org/docs/app/building-your-application/configuring/content-security-policy