Browser.js has so many inline styles not safe for production usage.

[mymah01]

Browser.js has so many inline styles not safe for production usage.
Fixable options:

1. using external css.
2. accepting csp nonce on those inline styles.

[rugk]

I guess this is basically a duplicate of #984 is not it?

[mymah01]

I guess this is basically a duplicate of #984 is not it?

Ok just seen #984, not a duplicate, but yes a hash is a shortcut workaround which changes when static code changes.

But it can definitely be made efficient by adding a nonce param to the options.. just like we can have the data locally etc.. to avoid extra test time to update the hash.

That way, the nonce is injected together with the inline styles injection.

Because for non monolithic apps (microservices), one would have to hit backend again to update csp hash if frontend logic (emoji-mart) changes. In production environments (using browser.js and not react etc), Nonce is your best solution to this problem.