Make EpiServer Forms compatible with Content Security Policy (without 'unsafe-*'
Content Security Policy (CSP (https://developer.mozilla.org/en-US/docs/Glossary/CSP is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS (https://developer.mozilla.org/en-US/docs/Glossary/XSS and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.
Current version of EpiServer Forms is not compatible with Content Security Policy (without 'unsafe-*'.
This requires us to change EpiServer Form Element to follow directives from our IT-Security apartment.
Please remove/replace all inline CSS and Javascript required to run EpiServer Forms.
Documentation:
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
Mattias Blomqvist
shared this idea