feat: added nonce capability for legacy Odyssey

[KevinGhadyani-Okta]

Description

Added a connection for legacy Odyssey apps to utilize a nonce.

[odyssey-okta]

@KevinGhadyani-Okta did you happen to look at the inline style assignment here? I'm not 100% certain this will be a CSP violation because of how I recall JSX compiling HTML attributes to JS property assignment as sugar but I could be wrong! cc @conorhanrahan-okta not sure if you're looked into this issue specifically for React/JSX yet?

[conorhanrahan-okta]

I haven't looked into it but I imagine there is a React solution that does it in a CSP safe way. If it's not happening already there is probably a plugin or configuration setting that would turn that into CSP safe element.style.display = 'none' type stuff

[odyssey-okta]

@conorhanrahan-okta @KevinGhadyani-Okta here are some more links. It's clear to me that React passes prop values as HTML attributes to custom elements but that isn't in play here. <Tag> in our example will only ever be an instrinsic DOM element like span or div.

https://custom-elements-everywhere.com/ (scroll down to React section)

[conorhanrahan-okta]

Is this the only warning produced by odyssey? Or are there more warnings to be fixed in other tickets?

[KevinGhadyani-Okta]

I noticed an issue from style-loader, but it's not related to Odyssey unless you're consuming the Sass. But that's a Webpack build tools issue not in Odyssey.

[KevinGhadyani-Okta]

Tested this in Monolith using existing libraries from Okta-UI-React as well as testing in Okta-UI-React's dev playground. We're good.