Content Security Policy (CSP) - Problem with dynamic inline style during OneTrust integration

1.2k Views Asked by Lukasz J At 14 January 2023 at 16:02

I am integrating a cookie tool - OneTrust. I add them by adding scripts in the <head> of the html page. The scripts call other scripts and create inline styles.

I manage to embrace all scripts by adding a 'nonce' to this scripts. I have a problem with inline styles which are created on the CDN domain of the OneTrust tool.

Is it possible to load scripts that contain dynamically injected inline styles with the style-src 'self' set in the Content Security Policy (CSP)?

Has anyone resolved a similar problem yet or is the only solution to add an 'unsafe-inline' directive to the style-src in CSP?

Original Q&A

There are 1 best solutions below

waternova On 18 August 2023 at 22:26

OneTrust now has a "preview" feature where you can provide a nonce for your script, but it has to be enabled by their support team.

<script nonce="PPAjsdRsCmdup5UwtyLkdg==" src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"" type="text/javascript" charset="UTF-8" data-domain-script="XXXXXXX" ></script>

https://developer.onetrust.com/onetrust/docs/content-security-policy-cdn

Content Security Policy (CSP) - Problem with dynamic inline style during OneTrust integration

There are 1 best solutions below

Related Questions in JAVASCRIPT

Related Questions in COOKIES

Related Questions in CONTENT-SECURITY-POLICY

Related Questions in INLINE-STYLES

Related Questions in ONE-TRUST

Trending Questions

Popular # Hahtags

Popular Questions