CSP for Ant Design: Nonces, CSS-in-JS, and Real Policies
Ant Design is one of those UI libraries that looks harmless from a CSP perspective until you actually turn on a strict policy. Then things get weird fast: styles stop rendering, wave effects break, overlays look unstyled, and your console fills with CSP violations. I’ve hit this enough times that I treat Ant Design as a “plan CSP early” dependency, not a “bolt it on later” one. The main issue is styling. Depending on your Ant Design version and setup, the library may inject styles dynamically. A strict style-src can block that unless you configure nonces properly. If you’re also using server-side rendering, React hydration, analytics, and a consent manager, the policy gets more realistic than a toy default-src 'self'. ...