Fix/nonce-ssg #245

vejja · 2023-10-17T13:37:52Z

Fix the issue where an immutable nonce value is injected in all pre-rendered pages if the nonce option is set to true

Types of changes

Bug fix (a non-breaking change which fixes an issue)
New feature (a non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Description

This PR solves the issue

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I have added tests to cover my changes (if not applicable, please state why)

vercel · 2023-10-17T13:37:59Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
nuxt-security	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 25, 2023 8:46am

vejja · 2023-10-17T13:39:42Z

Step 1 : add incremental test

- in SSG mode, modify the 99-cspNonce nitro plugin - in SSR mode, modify the headers for prerendered routes

vejja · 2023-10-17T17:47:14Z

step 2 : modify code blocks
Playground still allows to run local tests

- revert playground config setup to basis - remove uneccessary tryUseNuxt import in 99-cspNonce

vejja · 2023-10-17T17:52:54Z

step 3 - cleanup, playground reverted
Ready for review

Baroshem · 2023-10-17T18:32:55Z

This PR looks good. I will review it tomorrow probably but would also love the feedback from @trijpstra-fourlights :)

Baroshem · 2023-10-18T12:53:53Z

Hey @vejja

Lets reschedule merging this PR to rc.1 to rc.2 instead.

It might be safer to do that and focus on releasing today the version 1 which I have already tested.

Dont worry though! Your PR is first to be merged to 1.0.0-rc.2 branch so it wont dissapear :)

trijpstra-fourlights

Nice work, one small nitpick but LGTM

trijpstra-fourlights · 2023-10-18T14:07:03Z

playground/nuxt.config.ts

-    }
+    },
+    nonce: true


nitpick: seems to be a left-over from testing. Either we keep it in and add the relevant CSP settings as well or we remove it from the playground.

Correct, should be removed

Awesome guys!

Let's keep it in mind for 1.0.0-rc.2 version.

Thanks for the amazing work! 💚

Baroshem · 2023-10-18T16:48:42Z

Update.

Let's make it ready for the 1.0.0-rc.3. I needed to push a fix to 1.0.0-rc.1 because there was a bug that I didn't catch during testing. It was triggered once released to NPM :(

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [nuxt-security](https://nuxt-security.vercel.app) ([source](https://togithub.com/Baroshem/nuxt-security)) | [`1.0.0-rc.2` -> `1.0.0-rc.3`](https://renovatebot.com/diffs/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3) | [![age](https://developer.mend.io/api/mc/badges/age/npm/nuxt-security/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/nuxt-security/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>Baroshem/nuxt-security (nuxt-security)</summary> ### [`v1.0.0-rc.3`](https://togithub.com/Baroshem/nuxt-security/releases/tag/v1.0.0-rc.3): 1.0.0-rc.3 [Compare Source](https://togithub.com/Baroshem/nuxt-security/compare/42f7399289e8edc50b2c68e1e70b1012ac95d8dd...v1.0.0-rc.3) > 1.0.0-rc.3 is the next release candidate #### 🗞️ Next steps We are planning to release one or two more release candidate versions with bugfixes before a stable 1.0.0 version will be released. #### ✅ Migration Guide This version includes ⚠️ breaking changes but don't worry, we have prepared migration guide for you 😉 ##### In the previous version, `nonce` could be either an object with a type `NonceOptions` or `false`. ```ts export type NonceOptions = { enabled: boolean; mode?: 'renew' | 'check'; value?: (() => string); } ``` Now it is only a boolean value: ```ts export default defineNuxtConfig({ security: { nonce: true | false } } ``` This change was necessary to resolve security vulnerability for nonce reported by vejja [https://github.com/Baroshem/nuxt-security/pull/257](https://togithub.com/Baroshem/nuxt-security/pull/257). Read more about the new usage of nonce in this module https://nuxt-security.vercel.app/documentation/headers/csp#nonce 👉 Changelog [compare changes](https://togithub.com/Baroshem/nuxt-security/compare/v1.0.0-rc.1...v1.0.0-rc.3) #### 🚀 Enhancements - Add `credentialless` value to `Cross-Origin-Embedder-Policy` header - Export configuration type - Improve CSP Compliance - ensure csp plugins are added last - Extend CSP support of SSG mode - use cheerio HTML parser for CSP #### 🩹 Fixes - Basic Auth Configuration for Multiple Paths - Nonce value is injected in all pre-rendered pages if the `nonce` option is set to `true` #### 📖 Documentation - Clarify rateLimiter `interval` property #### 🏡 Chore - Improve TS config #### ⚠️ Breaking Changes - CSP Compliance #### ❤️ Contributors - Espen Solli Grande ([@espensgr](https://togithub.com/espensgr)) - vejja ([@vejja](https://togithub.com/vejja)) - Tristan ([@Tristan971](https://togithub.com/Tristan971)) - Jonas Thelemann ([@dargmuesli](https://togithub.com/dargmuesli)) - nsratha ([@rathahin](https://togithub.com/rathahin)) #### 🏋️‍♂️ New Contributors - [@espensgr](https://togithub.com/espensgr) made their first contribution in [https://github.com/Baroshem/nuxt-security/pull/261](https://togithub.com/Baroshem/nuxt-security/pull/261) - [@vejja](https://togithub.com/vejja) made their first contribution in [https://github.com/Baroshem/nuxt-security/pull/245](https://togithub.com/Baroshem/nuxt-security/pull/245) - [@rathahin](https://togithub.com/rathahin) made their first contribution in [https://github.com/Baroshem/nuxt-security/pull/267](https://togithub.com/Baroshem/nuxt-security/pull/267) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/maevsi/maevsi).

add test evidencing nonce issue in SSG

9500006

vercel bot deployed to Preview October 17, 2023 13:39 View deployment

fix: apply new test to SSG pre-rendered page in fixture

0fe16bb

vercel bot deployed to Preview October 17, 2023 13:56 View deployment

fix nonce issue

20b0966

- in SSG mode, modify the 99-cspNonce nitro plugin - in SSR mode, modify the headers for prerendered routes

vejja marked this pull request as ready for review October 17, 2023 17:46

vercel bot deployed to Preview October 17, 2023 17:47 View deployment

remove temporary code

f5dce18

- revert playground config setup to basis - remove uneccessary tryUseNuxt import in 99-cspNonce

vercel bot deployed to Preview October 17, 2023 17:52 View deployment

Baroshem changed the base branch from main to chore/1.0.0-rc.1 October 17, 2023 18:30

trijpstra-fourlights approved these changes Oct 18, 2023

View reviewed changes

Baroshem added this to the 1.0.0-rc.2 milestone Oct 18, 2023

Baroshem changed the base branch from chore/1.0.0-rc.1 to chore/1.0.0-rc.3 October 25, 2023 08:43

Baroshem approved these changes Oct 25, 2023

View reviewed changes

Merge branch 'chore/1.0.0-rc.3' into fix/nonce-ssg

9406b97

vercel bot deployed to Preview October 25, 2023 08:46 View deployment

Baroshem merged commit 92bddbe into nuxt-modules:chore/1.0.0-rc.3 Oct 25, 2023
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/nonce-ssg #245

Fix/nonce-ssg #245

vejja commented Oct 17, 2023 •

edited

Loading

vercel bot commented Oct 17, 2023 •

edited

Loading

vejja commented Oct 17, 2023

vejja commented Oct 17, 2023 •

edited

Loading

vejja commented Oct 17, 2023 •

edited

Loading

Baroshem commented Oct 17, 2023

Baroshem commented Oct 18, 2023

trijpstra-fourlights left a comment

trijpstra-fourlights Oct 18, 2023

vejja Oct 18, 2023

Baroshem Oct 18, 2023

Baroshem commented Oct 18, 2023

Fix/nonce-ssg #245

Fix/nonce-ssg #245

Conversation

vejja commented Oct 17, 2023 • edited Loading

Types of changes

Description

Checklist:

vercel bot commented Oct 17, 2023 • edited Loading

vejja commented Oct 17, 2023

vejja commented Oct 17, 2023 • edited Loading

vejja commented Oct 17, 2023 • edited Loading

Baroshem commented Oct 17, 2023

Baroshem commented Oct 18, 2023

trijpstra-fourlights left a comment

Choose a reason for hiding this comment

trijpstra-fourlights Oct 18, 2023

Choose a reason for hiding this comment

vejja Oct 18, 2023

Choose a reason for hiding this comment

Baroshem Oct 18, 2023

Choose a reason for hiding this comment

Baroshem commented Oct 18, 2023

vejja commented Oct 17, 2023 •

edited

Loading

vercel bot commented Oct 17, 2023 •

edited

Loading

vejja commented Oct 17, 2023 •

edited

Loading

vejja commented Oct 17, 2023 •

edited

Loading