New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BREAKING CHANGE SUGGESTION: remove nonce property #1654

Open

GalacticHypernova opened this issue Dec 29, 2024 · 0 comments

GalacticHypernova commented Dec 29, 2024 •

edited

Loading

The Nonce feature in Nuxt Image can bring many security concerns.
The biggest ones of them all are:

User provided nonce may not be cryptographically secure (partially or fully)
user provided nonce may not be standard-compliant (not generated with an appropriate algorithm)
User provided nonce may not be unique (user might reuse the nonce throughout multiple images)

It might be a better idea to leave the security of images for Nuxt Security to handle, as it takes care of all these concerns.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment