Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BREAKING CHANGE SUGGESTION: remove nonce property #1654

Open
GalacticHypernova opened this issue Dec 29, 2024 · 2 comments
Open

BREAKING CHANGE SUGGESTION: remove nonce property #1654

GalacticHypernova opened this issue Dec 29, 2024 · 2 comments

Comments

@GalacticHypernova
Copy link

GalacticHypernova commented Dec 29, 2024

The Nonce feature in Nuxt Image can bring many security concerns.
The biggest ones of them all are:

  1. User provided nonce may not be cryptographically secure (partially or fully)
  2. user provided nonce may not be standard-compliant (not generated with an appropriate algorithm)
  3. User provided nonce may not be unique (user might reuse the nonce throughout multiple images)

It might be a better idea to leave the security of images for Nuxt Security to handle, as it takes care of all these concerns.

@Baroshem
Copy link
Collaborator

Baroshem commented Jan 8, 2025

Hey @GalacticHypernova

I agree with this approach and can totally see why it could fail. Nuxt Security should handle it with nonce generation properly.

Or the upcoming CSP support for Nuxt framework in general :)

I wonder how we should approach it to not cause breaking changes instantly. Maybe we could add a note first that this prop will be deprecated with a newer version and users should use Nuxt Security instead?

@GalacticHypernova
Copy link
Author

I think this might be the best approach indeed. Perhaps it can become obsolete but still accepted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants