[CSP] Allow nonce passed through header (to support Turbolinks/PJAX) about nelmiosecuritybundle HOT 6 CLOSED

Please open a new issue, don't reply in something from 2017.

from nelmiosecuritybundle.

For the meta you need http-equiv not name as this an HTTP header, if your not sure you test this with something that should fail in that situation, load a script without a proper nonce. Assuming this works or believing it works because someone says yes is a dangerous practice.

from nelmiosecuritybundle.

With #139 , you could $container->get('nelmio_security.twig_extension')->getCSPNonce().

from nelmiosecuritybundle.

OH, you can currently do

$container->get('nelmio_security.csp_listener')->getNonce()

And it's much more cleaner

from nelmiosecuritybundle.

@romainneutron I don't think closing this is right. The request is not to allow reading the nonce, buit about setting it.

from nelmiosecuritybundle.

Edit: moved to #321

from nelmiosecuritybundle.