Security improvement hints about vitesse HOT 7 CLOSED

Thanks for looking into it. Indeed it's good to have better security scores, but I think it introduced too much friction but little to gain in this particular template. The inline script makes sure that dark mode is updated with the initial rendering (UX) while using nonce will make the script hard to modify (DX). This could deviate from the initial purpose of having a starter template. I think it's better to apply the security practices from the template users side based on their needs, rather than the template itself. Thanks for the tips and I believe someone would find this issue useful. Close as I think out-of-scope of this template.

from vitesse.

@antfu I agree with you, but I'm suggest to include the simple csp, not nonce based, due to the complexity it requires.

from vitesse.

include the simple csp

Sounds good, would you like to create a PR? Thanks

from vitesse.

Of course, I'm working on it, I need to finish some enterprise work...

@antfu I am reviewing pwa plugin to include New content available + REFRESH missing feature here, how can I integrate with this template?
I meant, I'm changing PWA plugin to notify update + changed events (based on register-service-worker repo).
In the other hand, I'm thinking to include it on @vueuse, something like useServiceWorker function, but I need to sort out a bit how it's going to be integrated first.
Some hints are welcome...

from vitesse.

pwa plugin to include New content available + REFRESH missing feature

Yeah, that's something I want to do for a while. But haven't look into it yet. It would be great if you would like to give it a try!

I'm thinking to include it on @vueuse, something like useServiceWorker function

Sounds good!

PWA is not my focus currently, but eventually, I will have a look and implement it. Sorry as I can't help you on this atm, but maybe you can draft some PRs so I can help to review it. Thanks!

from vitesse.

PS. Commonly I don't read notifications from closed issues, if you would like to keep the discussion, it's better to open another issue instead. vite-plugin-pwa could also be a better place.

from vitesse.

from vitesse.