Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

don't use style-loader in production #12

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

bj00rn
Copy link

@bj00rn bj00rn commented Mar 12, 2021

style-loader forces inline <style /> tags upon users of this library.

This is a security problem since it prevents the application of sane CSP configuration. ( requires style-src 'unsafe-inline';)

Webpack 4 has the superawesome MinCssExtractPlugin this purpose, this enables users of this library to use the webpack plugin pipline (html-webpack-plugin et al.) to decide if the wan't to inline the library styles or use them in a bundle.

The PR includes

  • use MinCssExtractPlugin plugin in production builds
    - upgrade to Webpack 4 in order to use MiniCssExtractPlugin

- upgrade to webpack 4 in order to use MiniCssExtractPlugin for production builds
@bj00rn bj00rn closed this Mar 9, 2023
@bj00rn bj00rn reopened this Mar 9, 2023
@bj00rn
Copy link
Author

bj00rn commented Mar 9, 2023

@fritz-c any thoughts?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant