Move most styles/scripts out of line and try to combine them where possible #2198
Replies: 5 comments
-
|
Just a sidenote, this is of course no request to change anything it is just a remark and I think there is at least some value in enabling people to implent strict CSPs even on a static site. It however is at least somewhat unnecessary compared to for example Wordpress etc. but that doesn't mean it isn't a good idea to do it if possible. Also thank you very much to everyone that has worked on this awesome project! The theme is what got me motivated to start with Hugo. |
Beta Was this translation helpful? Give feedback.
-
|
After merging #2209 and merging #2196 to my own site (instead of the theme) this is the full HTTP PUT/POST request to Cloudflare API. Now everything is below 4k chars (Max 3442 chars). There is still a lot of room for improvement though. |
Beta Was this translation helpful? Give feedback.
-
|
After merging #2211 aswell, the CSP is down to 3010 chars with (this should be clear, but of course only for that very simple site) with only very few hashes remaining in After also merging #2218 (where I removed all inline event handlers) all console errors due to inline event handlers are gone and as far as I can tell, the CSP works well for my simple site. I hope that these prs will get merged so that people will be able to use CSPs. EDITED BECAUSE: For my usecase this is a massive improvement and there is definetly still room for more. I'm not sure if there is an equally nice way to eliminate the remaining scripts/styles that wouldn't compromise on readability. Just as a proof of concept: This is the CI/CD now succeeding. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, after merging #2254 #2260 #2268 #2253 and #2252 there is only 2252 characters left of the CSP. I'm not sure if there are additional relevant commits, but I used my own tmp branch if you want to try this yourself. Also because of #2260, no manual overrides are required for this. The current CSP provides the same security as the one in #2198 (comment) but saves almost 50% of the characters. This is pretty great. You should remember that this is for a pretty simple site, but at least I have gotten rid of most of the annoying inline styles/scripts already. This is the current HTTP PUT/POST request to Cloudflare API. I don't use repo shortcodes at the moment, but #2269 has also moved those out of line. Just to keep this updated. |
Beta Was this translation helpful? Give feedback.
-
|
This is the current HTTP PUT/POST request to Cloudflare API. This is on the current dev branch (0999dc2) with #2252 merged aswell. That's |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
When trying to implement a content security policy I've noticed that it is quite hard to stay below some limits imposed by Cloudflare. As far as I know, other providers also impose limits on HTTP headers and I can't find any documentation for what that limit is exactly for Cloudflare.
This currently is the result of me using bash scripts to find inline and out of line styles/scripts and generating hashes for them:
For anyone interested, here is my current CI/CD generating these policies. And this is it failing. I btw couldn't find documentation on what
code 20087means but every time the CSP is over 4k chars it has been rejected so far.The CSP alone is 4145 characters. This contains all inline scripts/styles and also all out of line scripts (because of
'strict-dynamic') that are generated in./public. My site however is actually very simple. It has almost no text content, doesn't use any shortcodes like youtube embed etc.So for a larger site that character count increases. I have noticed this with a repo of example sites where they all have different content. This is an example for a full HTTP PUT/POST request to Cloudflare API for these sites.
Since you can't go below
sha256that means it is impossible to implement a CSP that doesn't violate these restrictions on HTTP header size.This btw uses a theme already merging #2194 and #2196.
Since I have not really contributed anything to this project yet, I don't want to just start moving everything out of line and upset someone. I am also not that familiar with the codebase.
Therefore I am asking:
Would you approve of moving scripts/styles out of line and trying to combine them to allow somewhat strict CSPs that can be deployed to for example Cloudflare?
Beta Was this translation helpful? Give feedback.
All reactions