Stencil: CSP Nonce Support for generated files

[MrMcGibblets]

Stencil version:

 @stencil/[email protected]

I'm submitting a:
[ ] bug report
[x] feature request
[ ] support request => Please do not submit support requests here, use one of these channels: https://stencil-worldwide.herokuapp.com/ or https://forum.ionicframework.com/

Current behavior:
Same as the closed issue - https://github.com/ionic-team/stencil/issues/496

When bundling we automatically create an inline style which violates the strict CSP usage

Whilst a workaround is to add each individual sha to the CSP policy it isn't ideal and not a nice dev experience.

In webpack this was achieved by adding a top-level nonce value which would then be added to all at bundle time. - https://github.com/styled-components/styled-components/issues/887

Expected behavior:
To be able to provide a nonce for styles (should be for all scripts, img etc...) that will be added to all build-generated scripts, styles etc... Allowing apps to be CSP ready out of the box.

Steps to reproduce:
Add CSP Policy for style-src 'self' and run app.

[BorntraegerMarc]

Working in an organization this is a critical feature for us. It's quite a hazzle to add sha values for our styles.

Was there any internal discussion in the ionic team about this feature?

[FrancoisDF]

Is there any update from the Stencil team in regard of this feature? We also have some concern that limit some of our teams to move ahead with the stencilJs web-components used by our design system.

[ptrot001]

Hi, Any update on this one? I can't believe nothing have been done yet to handle CSP in stencil libraries. Angular and react have added support for CSP in 2015-2016!

I'm also working in a big organization and CSP is a basic security requirement for us. It's a blocker right now!

Any update would be appreciated! 👍 @adamdbradley ?

Thanks