Conversation
supportI note that the database table ‘seasp_site_settings’ contains a column called ‘nonce_enabled’. I don’t see where the plugin manages nonces. For what purpose does this column serve?
Hey there, thanks for reaching out! We’ll check into this and get back with you as soon as possible.
Hey there this field is to support a future nonce feature. It needs a bit more testing before we can go live with it but I can give you an idea of what it is going to be. 1. users will be able to manually add nonces to specific directives 2. the plugin will generate a word press nonce that can be appended to your file names. The user will have to give a name to the nonce. Thank you for taking interest in our plugin I am glad you are really digging into the nuts and bolts. Would you mind leaving us a review? Also there is an update today! please let us know what you think. This next update to the plugin will include WordPress admin alerts and we fixed a bug where some domains were not getting entered correctly. We also added an opt in for plugin usage data collection.
To the extent that such nonces help avoid ‘unsafe-inline’ values for directives, that will be a very welcomr addition.
I agree I am also looking into adding support for SHA-256 hashes to avoid having unsafe inline for scripts. I am looking for a way to scrape those from the browser console when they are generated. Have not found a way yet though. For now I think those will be manual entry in the coming updates new interface.
Either that, or reproducing the same algorithm as used by the browser.
Hey there, thanks for reaching out! We’ll check into this and get back with you as soon as possible.
Hey there this field is to support a future nonce feature. It needs a bit more testing before we can go live with it but I can give you an idea of what it is going to be. 1. users will be able to manually add nonces to specific directives 2. the plugin will generate a word press nonce that can be appended to your file names. The user will have to give a name to the nonce. Thank you for taking interest in our plugin I am glad you are really digging into the nuts and bolts. Would you mind leaving us a review? Also there is an update today! please let us know what you think. This next update to the plugin will include WordPress admin alerts and we fixed a bug where some domains were not getting entered correctly. We also added an opt in for plugin usage data collection.
To the extent that such nonces help avoid ‘unsafe-inline’ values for directives, that will be a very welcomr addition.
I agree I am also looking into adding support for SHA-256 hashes to avoid having unsafe inline for scripts. I am looking for a way to scrape those from the browser console when they are generated. Have not found a way yet though. For now I think those will be manual entry in the coming updates new interface.
Either that, or reproducing the same algorithm as used by the browser.