CSP

[d65yan]

Hello All.
This is more of a question and maybe a request
Is it possible not to have link-initialize.js concat a random number to link-stylesheet-test- by adding. a random number it makes CSP throw errors and blocks the insertion.
Sometimes eval unsafe or nonce are not an option. Would it be possible to allow for the ids to be provided by through link config?

thank you

[skylarmb]

hi @d65yan how does removing the random number in the ID of the element it creates solve this? Wouldn't it be subject to the same style-src 'unsafe-inline' CSP either way? Ah! I see! You probably want to use use style-src-elem with a hash instead right, but the contents of the <style> tag changes.... got it! This is a resonable request.

[seromenho]

Something like this is also required for the nonce alternative.

Bumping this since the addition of the random number to link-stylesheet-test- also forces me to set style-src-elem as unsafe-inline instead of being able to use a hash

[MehdiSv]

Any news on this? 🙏

[gfrntz]

Any updates?

[jonahallibone]

It would be great to know if this is possible to remove, it get's flagged frequently by our security auditors

[jessebond2]

This still seems to be an issue. Could we please get proper CSP support?

[ssantichaivekin-plaid]

Hi! I’m looking into this issue and wanted to better understand the cases where unsafe-eval or a nonce are not viable options.

For context, we generally do not want customers to rely on a CSP hash for Plaid’s Link script. We update the hosted script frequently, including for bug fixes and other improvements, so a hash would be brittle and could break whenever the script changes. For that reason, I don’t think CSP hash support is something we can reliably support today.

That said, if you have a strong use case where neither a nonce nor the current CSP approach works, could you share more details about your setup and constraints? In particular, it would be helpful to understand why a nonce cannot be used in your environment so we can evaluate what options may be feasible.

In the meantime, if anyone is running into issues using this library with a CSP nonce, please share your details here (or privately through your TAM).

[smackfu]

That said, if you have a strong use case where neither a nonce nor the current CSP approach works, could you share more details about your setup and constraints?

The attack vector that our security people tend to be concerned about is: what if the Plaid JS CDN gets hacked and malware is inserted in the script? Using a integrity hash would protect us in that case, where I don't believe a nonce would help.

Now, as mentioned, this is a maintenance nightmare for us if you actually change the hosted script frequently, since the script would not load until we updated the integrity value and deployed. But that is the use-case.