Chat Space for @everyone

[Avdhesh-Varshney]

👋 Hey @Developers,
This is a general communication channel for all the open-source enthusiasts.
If you have any kind of query, feel free to drop the message in this forum.

[Avdhesh-Varshney]

@100NikhilBro Do you have a knowledge of "CSP headers not set" security issue?
I've get some solution for it. 👇

default-src 'self';
script-src 'self';
style-src 'self';

But this is not working as it's blocked inline-css, inline-scripts, etc.
👉 I want some alternative to setup CSP headers without change in FE and also pass ZAP test.

[100NikhilBro]

@Avdhesh-Varshney For now, we have set a relaxed CSP using Helmet that allows inline scripts and styles to avoid breaking the frontend.
This setup keeps the app safe with other security headers (XSS filter, HSTS, frameguard, etc.) and is fine temporarily.
In the future, we can implement a stricter nonce-based or hash-based CSP to fully pass ZAP tests without affecting the frontend.

Through Helmet:
helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"],
imgSrc: [""],
connectSrc: [""],
fontSrc: ["*"],
objectSrc: ["'none'"],
upgradeInsecureRequests: []
}
}
})

[Avdhesh-Varshney]

Right need to either using nonce or hash.
I've checked 'unsafe-inline' is not able to pass ZAP tests.
Thanks!