-
Notifications
You must be signed in to change notification settings - Fork 739
Open
Description
I'm implementing CSP for a page that has an island component.
If I set csp: true for that page, the nonce for the island's script tag gets removed.
<script id="__FRSH_STATE_e2edbfed-24ab-45b8-a5a1-2dee7f158563" type="application/json" nonce="">{"v":[[{"postId":83,"initialVoteCount":1,"hasVoted":true}],[]]}</script>Because of that, I see console errors saying the script is blocked.
Refused to load the script 'http://localhost:8000/_frsh/js/f175c03a9a27eda73b62be15536761b89088e2ea/main.js' because it violates the following Content Security Policy directive: "script-src 'nonce-a509e33ef6cb48288be0d7b103a82efb'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
If I turn it off,
<script id="__FRSH_STATE_80b83e7d-a15b-42eb-bac3-0f0581fc5e79" type="application/json" nonce="7fdd74f6cce746afb23fd4e4e7da7c9c">{"v":[[{"postId":83,"initialVoteCount":1,"hasVoted":true}],[]]}</script>Nonce is alive.
Am I missing something?
I followed the docs for implementing CSP with useCSP util.
Metadata
Metadata
Assignees
Labels
No labels