You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
My webserver (nginx, but I guess it doesn't matter) is configured with a strict CSP that allows only self and nonces.
All is fine when I browse pages, since the web debug toolbar is correctly rendered with proper nonces.
The problem is when I click on WDT to open the profiler: here the style and the script are blocked.
I noticed the same problem with the {{ dump() }} display.
The HTML code generated is ok, but the <script> are without "nonce" so my browser deny it and the expand/collapse in the sf-dump is not working. @fabpot , any solution ? 😕
Symfony version(s) affected
4.4 5.4 6.0 6.1
Description
My webserver (nginx, but I guess it doesn't matter) is configured with a strict CSP that allows only self and nonces.
All is fine when I browse pages, since the web debug toolbar is correctly rendered with proper nonces.
The problem is when I click on WDT to open the profiler: here the style and the script are blocked.
I see that, actually, the template of profiler is not using nonces at all.
How to reproduce
Use a nginx config like this one:
try to access the profiler on
/_profiler
URL.Possible Solution
Using the same variables (
csp_script_nonce
andcsp_style_nonce
) currently used for WDT.Additional Context
No response
The text was updated successfully, but these errors were encountered: