{"action":"created","issue":{"url":"https://api.github.com/repos/Track3/hermit/issues/22","repository_url":"https://api.github.com/repos/Track3/hermit","labels_url":"https://api.github.com/repos/Track3/hermit/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/Track3/hermit/issues/22/comments","events_url":"https://api.github.com/repos/Track3/hermit/issues/22/events","html_url":"https://github.com/Track3/hermit/issues/22","id":394813136,"node_id":"MDU6SXNzdWUzOTQ4MTMxMzY=","number":22,"title":"Content Security Policy","user":{"login":"graemer957","id":968615,"node_id":"MDQ6VXNlcjk2ODYxNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/968615?v=4","gravatar_id":"","url":"https://api.github.com/users/graemer957","html_url":"https://github.com/graemer957","followers_url":"https://api.github.com/users/graemer957/followers","following_url":"https://api.github.com/users/graemer957/following{/other_user}","gists_url":"https://api.github.com/users/graemer957/gists{/gist_id}","starred_url":"https://api.github.com/users/graemer957/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/graemer957/subscriptions","organizations_url":"https://api.github.com/users/graemer957/orgs","repos_url":"https://api.github.com/users/graemer957/repos","events_url":"https://api.github.com/users/graemer957/events{/privacy}","received_events_url":"https://api.github.com/users/graemer957/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-12-29T17:50:50Z","updated_at":"2019-01-02T10:43:52Z","closed_at":null,"author_association":"NONE","body":"Hi @Track3, firstly, thank you for creating this excellent theme. Finding it made my decision to use Hugo for my site easy 😀\r\n\r\nToday I spent some time adding a `Content-Security-Policy` for my [website](https://sigma957.net). I blogged about the steps I took [here](https://sigma957.net/posts/content-security-policy/), but in summary:\r\n\r\n* In order to allow `<script>let haveHeader = true;</script>` to execute I had to add the hash `sha256-AnD4MU8ryLQfUOxyB+K8iDV82R0rMK6os4wCSP8Cqqo=`\r\n* Similarly, to allow `<script>let haveHeader = false;</script>` to execute I had to add the hash `sha256-mzxFK7/AUlIhalqxiKcyRO9mSXWeALlmGjRumxphi9M=`\r\n* I saw an issue with the inline style applied in the HTML `<div id=\"mobile-menu\" class=\"animated fast\" style=\"display: none;\">`. The suggested hash Chrome gave me (`sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=`) did not work, so I had to add `unsafe-inline`\r\n\r\nI see Hugo adds an `integrity` attribute to other tags, but I am not sure if that only works if they are not inline?\r\n\r\nHere is the version information for the version of Hugo I am using:\r\n\r\n> Hugo Static Site Generator v0.53/extended darwin/amd64 BuildDate: unknown\r\n\r\nI have only just started to use Hugo, so please forgive me if I have missed something. Thanks in advance."},"comment":{"url":"https://api.github.com/repos/Track3/hermit/issues/comments/450832884","html_url":"https://github.com/Track3/hermit/issues/22#issuecomment-450832884","issue_url":"https://api.github.com/repos/Track3/hermit/issues/22","id":450832884,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDgzMjg4NA==","user":{"login":"Track3","id":34504964,"node_id":"MDQ6VXNlcjM0NTA0OTY0","avatar_url":"https://avatars2.githubusercontent.com/u/34504964?v=4","gravatar_id":"","url":"https://api.github.com/users/Track3","html_url":"https://github.com/Track3","followers_url":"https://api.github.com/users/Track3/followers","following_url":"https://api.github.com/users/Track3/following{/other_user}","gists_url":"https://api.github.com/users/Track3/gists{/gist_id}","starred_url":"https://api.github.com/users/Track3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Track3/subscriptions","organizations_url":"https://api.github.com/users/Track3/orgs","repos_url":"https://api.github.com/users/Track3/repos","events_url":"https://api.github.com/users/Track3/events{/privacy}","received_events_url":"https://api.github.com/users/Track3/received_events","type":"User","site_admin":false},"created_at":"2019-01-02T10:43:52Z","updated_at":"2019-01-02T10:43:52Z","author_association":"OWNER","body":"> even thought I was not using the background image feature the following HTML was still being generated, and failing\r\n\r\nYou should add this hash chrome gave you by hand in nginx.conf just like dealing with that `<script>let haveHeader = true;</script>` Because there's no way I can do to totally remove this. When you start to use background image, this is a different value, you should also add it then.\r\n\r\n> Does not seem like any changes to assets/scss/style.scss are being picked up when I rebuild site!\r\n\r\nIf you didn't use the extended version of Hugo, every time the theme has style updates, you should probably delete your site's resources folder before build."}}
{"actor":{"display_login":"Track3"}}