Removed unsafe-inline JS from CSP and other fixes #1834

New Issue

MrUnknownDE · 2026-04-06T02:27:16+02:00

MrUnknownDE commented

2026-04-06 02:27:16 +02:00

Originally created by @BlackDex on 12/28/2022

Removed unsafe-inline for javascript from CSP. The admin interface now uses files instead of inline javascript.
Modified javascript to work not being inline.
Run eslint over javascript and fixed some items.
Added a to_json Handlebars helper. Used at the diagnostics page.
Changed AdminTemplateData struct to be smaller. The config was always added, but only used at one page. Same goes for can_backup and version.
Also inlined CSS.
We can't remove the unsafe-inline from css, because that seems to
break the web-vault currently. That might need some further checks.
But for now the 404 page and all the admin pages are clear of inline scripts and styles.

*Originally created by @BlackDex on 12/28/2022* - Removed `unsafe-inline` for javascript from CSP. The admin interface now uses files instead of inline javascript. - Modified javascript to work not being inline. - Run eslint over javascript and fixed some items. - Added a `to_json` Handlebars helper. Used at the diagnostics page. - Changed `AdminTemplateData` struct to be smaller. The `config` was always added, but only used at one page. Same goes for `can_backup` and `version`. - Also inlined CSS. We can't remove the `unsafe-inline` from css, because that seems to break the web-vault currently. That might need some further checks. But for now the 404 page and all the admin pages are clear of inline scripts and styles.

MrUnknownDE closed this issue

2026-04-06 02:27:16 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1834