fcl forces us to use a less secure content-security-policy

[austinsamsel]

Instructions

Please fill out the template below to the best of your ability and include a label indicating which tool/service you were working with when you encountered the problem.

Problem

@onflow/protobuf calls eval in it. this is why my project is forced to allow unsafe-eval in our content-security-policy.

Steps to Reproduce

• you can check out this replication: https://github.com/austinsamsel/unsafe-eval-test/commits/main
• try npm install
• then npm run build && npm run start and expect to see csp errors in the console.
• if you checkout an earlier commit before fcl was added...
• you can then run npm run build && npm run start and the application will execute.

Acceptance Criteria

• javascript applications that use fcl do not need to allow unsafe-eval

Context

n/a

[bluesign]

Protobuf issue probably: protocolbuffers/protobuf-javascript#25

[orodio]

This also seems to be an issue for using fcl from inside of a browser extension.

cc: @gregsantos

[guanbinrui]

I have the same problem. Any workaround?

[boczeratul]

This was merged on Oct 15th and was included in google-protobuf@3.19.1
protocolbuffers/protobuf#8864

Updating google-protobuf version to @^3.19.1 should be able to fix this
@orodio @gregsantos

[boczeratul]

Hmm ok seems like google-protobuf@3.19.1 still hasn't fixed all CSP unsafe-eval issues

[bluesign]

I think REST api is very soon will solve all this problems.

[mikeylemmon]

@orodio @gregsantos Any update on this? It is preventing the use of the JS SDK in contexts where it would be very useful, such as Cloudflare Workers and browser extensions. Where can I find information/follow progress on the REST api?

[gregsantos]

@mikeylemmon The HTTP API has been released on testnet and mainet!
The Flow access node API for REST clients. Usable with the Flow CLI (Emulator) and FCL (Flow Client Library)

https://rest-testnet.onflow.org/v1/
Testnet: View Documentation

https://rest-mainnet.onflow.org/v1/
Mainnet: View Documentation

The SDK transport modules have moved into their own packages.
The JS-SDK now makes use of transport modules for sending an interaction to an access api and receiving a response.

More details available in the SDK CHANGELOG and on the Docs Site at onflow.org
HTTP-API Reference