[
https://issues.apache.org/jira/browse/MYFACES-4748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18067801#comment-18067801
]
Melloware commented on MYFACES-4748:
------------------------------------
[~tandraschko]i was looking at WHat Mojarra did and it looks like they just
always attach a script now and never use the `onclick` event?
> CSP: render f:ajax as script block instead e.g. onclick
> -------------------------------------------------------
>
> Key: MYFACES-4748
> URL: https://issues.apache.org/jira/browse/MYFACES-4748
> Project: MyFaces Core
> Issue Type: Task
> Reporter: Thomas Andraschko
> Priority: Major
> Fix For: 5.0.0
>
>
> i implemented most of the parts of CSP
> however, when the current request has a valid nonce, f:ajax script must be
> rendered inside a script block and attached to e.g. button via JS.
> instead of current onclick="...ajax script" attribute rendering
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
