WAYF pagina needs unsafe-inline CSP because of embedded json/js

[baszoetekouw]

The WAYF page currently requires setting a (non-recommended) value unsafe-inline for the CSP script-src property. This is needed because of the dynamic inclusion of the json with available IdPs.

It would be nice if we could change this. I see two possible solutions:

• instead of embedding the json in javascript, load it from an external API call. This had the advantage that the WAYF page itself can because completely static HTML and all logic can be in the API call. Might be quite some work though.
• use a nonce-system, in which a non-guessable none is added to both the CSP header and the embedded javascript. Disadvantage is that the nonce value will need to be communicated to the web server in some way, or the page will have to set its own CSP header.