View Issue Detail

ID	Project	Category	Submitted / Last Updated
02197	UserSpice	Triage	2025-10-27 08:31:30
Reported	Espresso Dan	Assigned To	Unassigned
Priority	none	Reported	5.9.6
Status	new	Resolution Version and Commit
Summary	Functionality suggestion - Nonced scripts
Description	The current security updates are a big move forwards for UserSpice. Currently, the ability to apply a robust CSP is limited due to the use of inline scripts in many admin functions. I currently deal with this in my production sites by generating a CSP nonce within a session. This works well for validating inline scripts. Can I suggest that adding a basic function to the frontend to place a nonce in inline scripts in the user interface would enable the use of a better CSP for most users, as 'unsafe-inline' is definitely considered poor practice now and without it the userspice admin frontend is effectively broken.