Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
If a site happens to disable unsafe- directives for CSP, effectively having the strictest CSP, the progress bar will not load because the default template (core/modules/system/templates/progress-bar.html.twig) uses <div style>
Steps to reproduce
Enable CSP module, or any other method of using CSP, ensure all unsafe- directives are disabled.
CSP module settings:
Proposed resolution
Do something else that doesnt use `style` attribute.
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
| Comment | File | Size | Author |
|---|
Comments
Comment #2
quietone commentedHi, If this problem was discovered on a version of Drupal that is not 11.x, add that information in the issue summary and leave the version at 11.x. In Drupal core changes are made on on 11.x (our main development branch) first, and are then back ported as needed according to the Core change policies. Thanks.
Comment #3
dpiComment #4
dpiComment #5
angel_devoeted commentedHi, thanks for sharing this.
The described behavior makes sense with strict CSP. Before discussing a specific resolution, I think it would be helpful to clarify whether strict CSP compatibility for the progress bar is considered in scope for core, given that it’s primarily used in admin/batch contexts where CSP is often excluded.
Comment #6
longwaveOne fix would be to convert the progress bar to use the
<progress>element?https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/pro...
#1477550: Bring progressbar to the postmodern era is somewhat dated but also suggests that as an option.
Comment #7
dpiIf there is any place CSP should be on above all others, is when a user with privileged access is authenticated.
For the CSP module, there is no delineation between roles or front/admin theme. Its either on, in reporting mode, or off: globally.
Drupal should aim for as strict as possible compliance, though it hasnt been prioritized as far as I know. Besides, the problem at hand, inline styles and script, are also not best practice either.