Add support for __webpack_nonce__ to inline styles CSP

[mcm-ham]

Bug Report or Feature Request (mark with an x)

- [ ] bug report -> please search issues before submitting
- [x] feature request

Command (mark with an x)

- [ ] new
- [x] build
- [ ] serve
- [ ] test
- [ ] e2e
- [ ] generate
- [ ] add
- [ ] update
- [ ] lint
- [ ] xi18n
- [ ] run
- [ ] config
- [ ] help
- [ ] version
- [ ] doc

Versions

node: 10.8.0
npm: 6.3.0
ng: 6.2.3
os: Windows 10

Desired functionality

I would like the ability to define a nonce generated on the server that angular will add to the inline styles so that I can comply with business requirements not to use 'unsafe-inline' in CSP.

Mention any other details that might be useful

https://webpack.js.org/guides/csp/
webpack-contrib/style-loader#319

Adding webpack_nonce to the entry file did work for injected script tags but not the injected style tags used for the component css.

This is more of a support question but worth considering when documenting. To use this feature properly we should cryptographically generate the nonce on the server when serving the angular app to the client and use in entry file. Not sure the intended webpack way to do this but tried this suggestion without success styled-components/styled-components#887 (comment) .

[clydin]

Note that this is something that Angular itself would need to support; as it (and not webpack) adds the styles at runtime.

[clydin]

Also, to properly use a nonce, it should be randomly generated by the server upon each request to prevent it from being easily guessed; necessitating a server with HTML templating. And there would need to be additional Angular APIs to support this and allow Angular to be aware of the current nonce.

[clydin]

If you are interested in pursuing this, can you open an issue on angular/angular regarding the ability to add a customizable nonce attribute to injected style elements?

[mcm-ham]

Thanks clydin have opened a feature request in the angular repo.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}