Description
Flask Talisman is often used to secure a flask application.
If Flask Talisman is added to a Flask Restx project, the Swagger UI is no longer rendered in any modern browser. Adding Flask Talisman is done with:
from flask import Flask
from flask_talisman import Talisman
app = Flask()
...
Talisman(app)Browser says: Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-xmHxD8PCyVLff5pky6+I50yPBEE+4wkuKmblJOCd+Wo='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.
Reason is the inline CSS in
The easiest solution would be to move this inline CSS to an extra file. Generating a nonce or hash seems to be too complicated as it needs to be done on every page request. Also, it would require a direct integration between Flask Restx and Talisman.
A workaround is allowing such inline CSS, but this basically makes using a content security policy pointless.
Talisman(app, content_security_policy={
'style-src': [
'\'unsafe-inline\'',
'\'self\'',
]
})Environment
- Python version: 3.8.6
- Flask version: 1.1.2
- Flask-RESTX version: 0.2.0
- flask-talisman: 0.7.0