Yesterday, 06:32 PM
Hello everyone,
I am currently working on hardening an IntraWeb application (IW 16.1.9, standalone execution) that relies on HTML Bootstrap templates and custom JavaScript/jQuery.
During a recent penetration test and security audit, the use of 'unsafe-eval' and 'unsafe-inline' in our Content Security Policy (CSP) headers was flagged as a high-risk finding.
While we are in the process of implementing dynamic request-based nonce values for external scripts and templates, we understand that IntraWeb's core rendering engine heavily relies on:
Inline event handlers (onclick, onchange, etc.) generated by native IW controls.
Async/AJAX response processing, which dynamically evaluates incoming JS snippets on the client side.
Given these architectural constraints:
Is there an official or recommended pattern to achieve strict CSP compliance within IntraWeb without breaking the core AJAX functionality?
Beyond using nonces, are there specific ServerController configs, event hooks, or best practices to eliminate or strictly limit the exposure of 'unsafe-eval' and 'unsafe-inline'?
Any insights, workarounds, or roadmap details regarding future CSP enhancements in IW 16.x would be greatly appreciated.
Thanks in advance for your guidance!
Best regards
I am currently working on hardening an IntraWeb application (IW 16.1.9, standalone execution) that relies on HTML Bootstrap templates and custom JavaScript/jQuery.
During a recent penetration test and security audit, the use of 'unsafe-eval' and 'unsafe-inline' in our Content Security Policy (CSP) headers was flagged as a high-risk finding.
While we are in the process of implementing dynamic request-based nonce values for external scripts and templates, we understand that IntraWeb's core rendering engine heavily relies on:
Inline event handlers (onclick, onchange, etc.) generated by native IW controls.
Async/AJAX response processing, which dynamically evaluates incoming JS snippets on the client side.
Given these architectural constraints:
Is there an official or recommended pattern to achieve strict CSP compliance within IntraWeb without breaking the core AJAX functionality?
Beyond using nonces, are there specific ServerController configs, event hooks, or best practices to eliminate or strictly limit the exposure of 'unsafe-eval' and 'unsafe-inline'?
Any insights, workarounds, or roadmap details regarding future CSP enhancements in IW 16.x would be greatly appreciated.
Thanks in advance for your guidance!
Best regards