1.0.0-rc.3

[Baroshem]

1.0.0-rc.3 is the next release candidate

🗞️ Next steps

We are planning to release one or two more release candidate versions with bugfixes before a stable 1.0.0 version will be released.

✅ Migration Guide

This version includes ⚠️ breaking changes but don't worry, we have prepared migration guide for you 😉

In the previous version, nonce could be either an object with a type NonceOptions or false.

export type NonceOptions = {
  enabled: boolean;
  mode?: 'renew' | 'check';
  value?: (() => string);
}

Now it is only a boolean value:

export default defineNuxtConfig({
  security: {
    nonce: true | false
  }
}

This change was necessary to resolve security vulnerability for nonce reported by vejja #257. Read more about the new usage of nonce in this module https://nuxt-security.vercel.app/documentation/headers/csp#nonce

👉 Changelog
compare changes

🚀 Enhancements

• Add credentialless value to Cross-Origin-Embedder-Policy header
• Export configuration type
• Improve CSP Compliance
• ensure csp plugins are added last
• Extend CSP support of SSG mode
• use cheerio HTML parser for CSP

🩹 Fixes

• Basic Auth Configuration for Multiple Paths
• Nonce value is injected in all pre-rendered pages if the nonce option is set to true

📖 Documentation

• Clarify rateLimiter interval property

🏡 Chore

• Improve TS config

⚠️ Breaking Changes

• CSP Compliance

❤️ Contributors

• Espen Solli Grande (@espensgr)
• vejja (@vejja)
• Tristan (@Tristan971)
• Jonas Thelemann (@dargmuesli)
• nsratha (@rathahin)

🏋️‍♂️ New Contributors

• @espensgr made their first contribution in Update 3.crossOriginEmbedderPolicy.md #261
• @vejja made their first contribution in Fix/nonce-ssg #245
• @rathahin made their first contribution in Fix Basic Auth Configuration for Multiple Paths #267

---

This discussion was created from the release 1.0.0-rc.3.

[dargmuesli]

Starting with this release there is no nonce added to statically generated pages anymore it seems to me 🤔

[dargmuesli]

I'll be using script-src now as proper WebKit support seems to be missing for script-src-elem anyway.

[Baroshem]

@vejja

Would you maybe be able to write some documentation for what you just explained to Jonas? I think more users could have similar issue so maybe it would be beneficial to have even a short senctence or two of your explanation :)

[Baroshem]

@vejja

Have you maybe included what you explained to Jonas above in the recent docs rewrite about CSP?

Should we maybe address it somehow in the main docs or in the FaQ section?

[vejja]

Yes I think it is now comfortably explained in the docs after the re-write
In addition with the new defaultConfig for CSP, it should work out of the box without any configuration change from the user.

We can still document script-src-elem separately somewhere ?

[Baroshem]

@vejja

Thanks for clarification. Could you create an issue for addding documentation about this missing element?

I can do it in the uocoming days :)