Creating reports and dashboards | Stimulsoft community forum

Hello, I'm trying to use the Stimulsoft viewer using the npm package (similarly as the Integrating the Report Viewer into an Application (TypeScript) sample). All works fine so far, but I ran into some CSP issues and I couldn't find anything in the documentation and forum, so I decided to create a new topic here.

The thing is, I have a stricter content security policy set up on my site and I'm getting some violation errors because of that. I figured I have to allow unsafe-inline for styles and scripts to make the viewer work, but I wanted to ask if maybe there is some setting to disable inline scripts and styles or a possibility to add a nonce to whitelist the inline parts.

You can surely reproduce the issue when you add this meta tag to any of the examples' index.html and try to load reports like ChartStyle.mrt, MasterDetail.mrt or so on.
If I edit the policy like this, the reports render fine, but it's not very desirable from the security point of view.

Hello,

We need some additional time to investigate the issue, we will let you know about the result.

Thank you.
#8879

Hello,
do you have any result after two years ?

Thank you in advance.

Hello,

Unfortunately, this is not realistic, because our scripts generate and insert content directly in the browser.
The ASPNET version loads the generated content and inserts it in the same way.

Thank you.

Hello Lech,
ok, I understand.
So what to support CSP Unsafe Hash?
This means inserting a nonce attribute with a hash into each element where the style attribute is set, which would be filled into some property on the designer.

Hello,

Unfortunately, it is not possible.

Thank you.