Stott Security 2.3

[GeekInTheNorth]

Version 2.3.0

This update has been published to api.nuget.optimizely.com and nuget.org.

This release introduces support for for nonce and strict-dynamic for the script-src, style-src and their derivatives. Please note that there is some specific extra steps for ensuring your script and style tags have their nonce attributes updated, so checkout the Read Me. There has been some interesting challenges in making the CSP nonce work for the site and as such I've had to conditionally apply it depending on whether you are on a content page or within the CMS editor experience.

If you'd like to support a change for nonce support in the CMS Editor / Administrator experience, then please visit this page and vote for this change: Support CSP with nonce in Edit, Admin etc

Features

• UI Updates #172
  • Merge CSP Sandbox tab into the CSP Settings tab.
  • Update Audit tab to format dates in a more human readable format, e.g. 21st Jan 2024.
  • Update question text on the modal for creating a CSP entry from an Allow List Violation.
  • Update styles on the Header Preview tab.
  • Update Service Extension method names to be more clear which module is being configured.
• Add support for NONCE attributes #36
  • Add support for Nonce values in the CSP.
  • Add support for strict-dynamic in the CSP.
  • Nonce and strict-dynamic will be applied only to content pages and the header listing API.
  • Please note there are additional configuration instructions in the readme to enable 'nonce' support.

---

This discussion was created from the release Stott Security 2.3.0.0.

Help me celebrate this release with a coffee! ☕️