Hey guys, another one from me when you have a moment—I'm just trying to strengthen our Content Security Policy by removing unsafe-inline from script_src (https://content-security-policy.com/unsafe-inline/), and I'm getting some violations on the Avo pages. Looks like it's coming from turbo within Avo. I noticed this has come up once or twice in GH issues (e.g. https://github.com/avo-hq/avo/issues/4284#issuecomment-3990637667) and wondered if there's a go-to solution yet, or is the only option to override/disable that CSP protection on the Avo ApplicationController?

Thread automatically created by timwis in #1138182212655788054

Hi @sparse-hair-56061 We'll have a look and get back to you

Wow, thanks! Will try it now. Sorry I missed your reply yesterday evening. To answer it, I'm just injecting

document.addEventListener('securitypolicyviolation', ...)

into my system tests, populating an array there, and then I check the array in a

config.after

block for each system test example (rspec).

Interesting strategy! Thanks for sharing

I'm still getting some violations, but I think it's just because of Turbo. If I use a session-based nonce, rather than a random one for each request (as you'd ideally do, from what I understand), Turbo's happy.