Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

application builder - modulepreload - issues with content security policy #26330

Closed
1 task done
joergbaier opened this issue Nov 10, 2023 · 1 comment · Fixed by #26687
Closed
1 task done

application builder - modulepreload - issues with content security policy #26330

joergbaier opened this issue Nov 10, 2023 · 1 comment · Fixed by #26687
Labels
angular/build:application area: @angular-devkit/build-angular freq1: low Only reported by a handful of users who observe it rarely severity3: broken type: bug/fix

Comments

@joergbaier
Copy link

joergbaier commented Nov 10, 2023 •
edited
Loading

Command

build

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

@angular-devkit/build-angular:browser

Description

In angular.json we use "subresourceIntegrity": true to generate a strict-dynamic CSP.

Our angular application is hosted as a static website (S3 & CloudFront).

The content security policy is added via a response headers policy. This has a 1783 character limit.

@angular-devkit/build-angular:browser

Initial script chunks in index.html

<body>
  <script integrity="sha384-A..." src="runtime...js"></script>
  <script integrity="sha384-B..." src="polyfills...js"></script>
  <script integrity="sha384-C..." src="main...js"></script>
</body>

Snippet of the generated CSP

script-src 'sha384-A...' 'sha384-B...' 'sha384-C...' 'strict-dynamic' ...

Works as expected.

@angular-devkit/build-angular:application

Initial script chunks in index.html

<head>
  <!-- about 25 of these modulepreloads -->
  <link rel="modulepreload" integrity="sha384-..." href="chunk...js" />
</head>
<body>
  <script integrity="sha384-A..." src="polyfills...js"></script>
  <script integrity="sha384-B..." src="main...js"></script>
</body>

Issues

  • Add modulepreload and script shas to the CSP
    • This will exceed the character limit
  • Only add script shas to the CSP
    • Works in safari, probably because safari does not support modulepreload
    • Does not work in chome and firefox. The CSP blocks loading a chunk...js from main...js.
  • Remove all modulepreload from index.html and add script shas to the CSP
    • Works in safari, probably because safari does not support modulepreload
    • Does not work in chome and firefox. The CSP blocks loading all 25 chunk...js from main...js.

Is there a way to disable the modulepreload? Or is there something else that I should consider when using the application builder?
@alan-agius4 alan-agius4 added area: @angular-devkit/build-angular freq1: low Only reported by a handful of users who observe it rarely severity3: broken labels Nov 15, 2023
@joergbaier joergbaier changed the title application builder - issues with content security policy application builder - modulepreload - issues with content security policy Nov 27, 2023
@clydin clydin mentioned this issue Dec 15, 2023
Merged
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Jan 18, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
angular/build:application area: @angular-devkit/build-angular freq1: low Only reported by a handful of users who observe it rarely severity3: broken type: bug/fix
Projects
None yet
Milestone
No milestone
3 participants
@joergbaier @dgp1130 @alan-agius4