Hi,
We are trying to hardening our websites against XSS attacks.
We therefore make the following settings in Joomla’s http-header Plugin:
- Nonce: activated
- Script-Hashes: activated
- Style-Hashes: activated
- Frame-ancestors ‘self’: activated
- Despite other settings we set the following Policy Directive:
- script-src
- ‘self’ ‘unsafe-hashes’ ‘sha256-xxxx’
But now we encounter an issue with your component chronoforms8 as it renders the scripts without Joomla’s WebAssetManager and therefore no nonce is added and your scripts gets blocked. Yes we can and already did some sha-exceptions for your inline scripts and it works so far so good.
But we cannot be sure to have added all possible scripts, when something changed to the form, the sha's might be different und scripts gets blocked again.
Can you please extend your component to add scripts and styles always using Joomla’s WebAssetManager?
Best Regards
