The Angular docs mention CSP, and Google's Security Engineers recommend against using whitelists. What I haven't figured out yet is how to inject a nonce into the script tag(s) that Angular injects into the index.html (to "bootstrap" itself). I suppose it has to do with Webpack, but the ng eject command has been removed from the cli a while ago, I believe, and I haven't been able to find a tutorial on this. Can anyone get me started with pointers, please?
The Webpack docs mention that a variable
__webpack_nonce__ = 'let-nonce-string-be-injected-by-server-here';
needs to be defied in the entry file (not the config - so an @angular-builders/custom-webpack npm module is probably not going to help?), but I'm not clear what Webpack's entry file is in the context of Angular...?
P.S.: Judging from this blog post, the polyfill file is one of the entry files - but it looks like it's not the first, so I doubt adding the variable there will work...?