Backpack Issues Using CSP #1399
Replies: 1 comment
-
|
Short answer: Backpack’s views do include inline scripts in various CRUD and Base templates, so a strict CSP that forbids inline JS will trigger violations. The knowledge sources don’t document CSP support or a built‑in way to inject nonces into Backpack’s shipped views. I’m sorry, but there’s no information about an official CSP-friendly mode or guidance for adding nonces to all Backpack inline scripts. What you can do based on the sources:
Given that, your two options are the ones you already identified:
If you need strict CSP without unsafe-inline, the only path suggested by the available sources is to override the necessary Backpack views and add nonces yourself. The knowledge sources do not explicitly mention any built-in nonce support or a global hook to apply nonces across all Backpack inline scripts. ℹ️ Please note our AI Bot does not reply to follow-ups, this will be the only AI answer in this thread. If the AI helped you find the answer, please mark it as answered or write details below so it can learn. Then close the conversation. If not, please give more information for when a human reads this. ℹ️ Relevant sources: Github Issue (closed): [4.0][Feature][Proposal] Remove dependency on CDNs - make Backpack work offline |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I'm adding CSP (Content Security Policy) functionality to one of our apps using the Spatie Laravel CSP package and I'm seeing issues in the Backpack views.
Many of the CRUD and Pro blade templates contain javascript inside <script> tags and those are causing CSP violations. I could either publish all the relevant views and add the @cspNonce directive (a monumental task) or I could just use unsafe-inline, which would negate the point of using CSP.
Has anyone else run into this issue? Am I missing something?
Beta Was this translation helpful? Give feedback.
All reactions