flask-talisman use js scripts located in static/js/folders

Question

I am trying to implement CSP using flask-talisman (new to that). I managed to load external cdns but I can't use my own scripts located in /static/js/[folders]/[subfolders]/file.js ex. in template html:

<script src="{{ url_for('static', filename='js/leaflet_handlers/realtor_overlays.js') }}"></script>

<script nonce="{{ csp_nonce() }}">
functionIn_realtor_overlays();

</script>

then at the functionIn_realtor_overlays() level, I get error: ip/...static/js/.../realtor_overlays.js " was blocked due to MIME type (“text/plain”) mismatch (X-Content-Type-Options: nosniff)"

my csp dict is:

tal_csp = {
    'default-src': ['\'self\'',
                    'https://unpkg.com', 'https://googletagmanager.com',
                    'https://www.googletagmanager.com', 'https://code.jquery.com',
                    'https://cdn.jsdelivr.net', 'https://cdnjs.cloudflare.com'
                    ],
    'script-src': ['\'self\'',
                   'https://unpkg.com', 'https://www.googletagmanager.com', 'https://code.jquery.com',
                   'https://cdn.jsdelivr.net', 'https://cdnjs.cloudflare.com',
                   ],

}

which I call at the app level liek this:

Talisman(app,
         content_security_policy=tal_csp,
         content_security_policy_nonce_in=['script-src']
         )

it seems that I may need to include a new key ('X-Content-Type-Options') in my tal_csp dict but I am not sure how and didn't find an example so far. Any help would be greatly aprecaited thank you

NB: I currently run the app on Windows debug and then the prod will be on Ubuntu server, using difefrent ip/url/port to the static folder

Je Je · Answer 1 · 2023-06-01T14:33:14.487

In case that helps others.

After further reading, this may be caused by a "bug" on Windows registry: link to flask github issues I had same issue whether I use Talisman to implement my CSP or do it myself (see this for an example.

I ended up using the bellow code before creating the app and it now seems to work as expected.

import mimetypes

mimetypes.add_type('text/css', '.css')
mimetypes.add_type('application/javascript', '.js')

NB: I was running my app in debug mode on windows and use ubuntu/gunicon/nginx for prod.

flask-talisman use js scripts located in static/js/folders

1 Answers1