Some functionality limited if you implement CSP

[dombarnes]

Various pages on in the engine rely on inline CSS and Javascript. If you implement Content Security Policies in your Rails app, these fail to load, unless you explicitly enable unsafe-inline.

Swap to using something like

<%= javascript_tag nonce: content_security_policy_nonce do %>
 // your javascript
<% end %> 

to make this work with

Rails.application.configure do
  config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
  config.content_security_policy_nonce_directives = %w[script-src]
end

Otherwise you'll need

Rails.application.configure do
  config.content_security_policy do |policy|
    policy.script_src(:unsafe_inline)
  end
end

Or just include some notes in the documentation.