CSP: It's not possible to use CSP with sha- hash (unsafe-inline)

[miszol1]

Is your feature request related to a problem? Please describe.

Storybook build generates <script> tag with bundle imports which names are changed every build so it's not possible to add sha- hash to CSP rules.

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' ' 'sha256-74W3pJKzljUvsnHfa3a/yD5D2l2a+v6h4cvDkK3BTBc=' [...]. Either the 'unsafe-inline' keyword, a hash ('sha256-VfmnZbxn4uj8kYlXE40O3+HIUmYwm7I1GlxeMBphGGM='), or a nonce ('nonce-...') is required to enable inline execution.

Screenshots:

• Storybook 7
• Angular 15

Describe the solution you'd like

Storybook does not generate inline scripts OR storybook generates inline scripts with the same hash every build.

Describe alternatives you've considered

No response

Are you able to assist to bring the feature to reality?

no

Additional context

No response

[miszol1]

Workaround is to set static name for bundles in webpack configuration.