Option to disable hashing for SSG

[jekuer]

Hi!

Is there a way to disable the hashing of JavaScript?
I am using some CSP and Nuxt SSG.
It would work fine, since I added "unsafe-inline". However, "unsafe-inline" is not respected, because this module adds some hashes to the CSP. I do not need the hashed values with unsafe-inline. Can I turn this off somehow?

Thanks in advance!
Jens

[Baroshem]

Hey Jens,

I am afraid that I do not understand fully what you would like to achieve. Could you please create some reproduction so that I could test it out?

I would like to help but at this point I do not understand fully what should be done :)

[Baroshem]

This explains a lot. I thought that this was caused by the module.

Then if you dont want CSP for SSG (and you have it in one application) you can use the rule I showed above. It will not register the nitro plugin and the meta wont be added to your application.

[Baroshem]

However, for disabling the hashes, I think we would need to add another configuration option like:

security: {
   ...
   ssg: {
      hashScripts: false
   }
} 

If you would like to contribute with such idea, please do so for 1.0.0-rc.1 branch.

[jekuer]

Awesome!
I missed the option to disable a single header. Working now.
Sorry for the confusion. Really appreciate your active support!!

Regarding the hashes: Any reason why you prefer it nested below "ssg"? Would make this rather more global.

[Baroshem]

Because it is only used in SSG. For SSR apps, user will use the response headers. And also to keep it organized in the module configuration as other options usually refer to headers or middleware

[Baroshem]

Added this functionality here 644deee :)