diff --git a/src/module.ts b/src/module.ts index 20088d77..f7b16202 100644 --- a/src/module.ts +++ b/src/module.ts @@ -230,32 +230,32 @@ const registerSecurityNitroPlugins = ( config.plugins.push( normalize( fileURLToPath( - new URL("./runtime/nitro/plugins/hidePoweredBy", import.meta.url) + new URL("./runtime/nitro/plugins/01-hidePoweredBy", import.meta.url) ) ) ); } - // Nitro plugin to enable nonce for CSP - if (nuxt.options.security.nonce) { + // Register nitro plugin to enable CSP for SSG + if ( + typeof securityOptions.headers === "object" && + securityOptions.headers.contentSecurityPolicy + ) { config.plugins.push( normalize( fileURLToPath( - new URL("./runtime/nitro/plugins/cspNonce", import.meta.url) + new URL("./runtime/nitro/plugins/02-cspSsg", import.meta.url) ) ) ); } - // Register nitro plugin to enable CSP for SSG - if ( - typeof securityOptions.headers === "object" && - securityOptions.headers.contentSecurityPolicy - ) { + // Nitro plugin to enable nonce for CSP + if (nuxt.options.security.nonce) { config.plugins.push( normalize( fileURLToPath( - new URL("./runtime/nitro/plugins/cspSsg", import.meta.url) + new URL("./runtime/nitro/plugins/99-cspNonce", import.meta.url) ) ) ); diff --git a/src/runtime/nitro/plugins/hidePoweredBy.ts b/src/runtime/nitro/plugins/01-hidePoweredBy.ts similarity index 100% rename from src/runtime/nitro/plugins/hidePoweredBy.ts rename to src/runtime/nitro/plugins/01-hidePoweredBy.ts diff --git a/src/runtime/nitro/plugins/cspSsg.ts b/src/runtime/nitro/plugins/02-cspSsg.ts similarity index 100% rename from src/runtime/nitro/plugins/cspSsg.ts rename to src/runtime/nitro/plugins/02-cspSsg.ts diff --git a/src/runtime/nitro/plugins/cspNonce.ts b/src/runtime/nitro/plugins/99-cspNonce.ts similarity index 89% rename from src/runtime/nitro/plugins/cspNonce.ts rename to src/runtime/nitro/plugins/99-cspNonce.ts index 0f8189b4..4eedea42 100644 --- a/src/runtime/nitro/plugins/cspNonce.ts +++ b/src/runtime/nitro/plugins/99-cspNonce.ts @@ -27,6 +27,12 @@ export default function (nitro) { if (!nonce) { return } + // Replace nonce attribute in http-equiv meta tag + html.head = html.head.map((meta) => { + if (!meta.startsWith(' link.replaceAll(tagNotPrecededByQuotes('link'), ` link.replaceAll(tagNotPrecededByQuotes('link'), `