EmDashHead JSON-LD scripts are injected via HTML string and are not CSP-hashed #1782

khoinguyenpham04 · 2026-07-03T16:59:34Z

khoinguyenpham04
Jul 3, 2026
Maintainer

This Roadmap discussion mirrors #1601: EmDashHead JSON-LD scripts are injected via HTML string and are not CSP-hashed.

Use this discussion to upvote the roadmap item and discuss priority, use cases, and product feedback. Keep implementation tracking, reproduction details, and PR-specific feedback on the source issue.

Source issue: #1601
Status: Closed
Labels: bug, bot:working, bot:bug
Original author: diogoascarneiro

Original Issue

Description

EmDashHead renders JSON-LD <script type="application/ld+json"> tags by building an HTML string and injecting it with set:html. Astro's CSP hash tracking does not appear to see these generated inline scripts, so strict CSP blocks the JSON-LD script tags at runtime.

Relevant EmDash implementation paths:

emdash/src/components/EmDashHead.astro
emdash/src/page/metadata.ts

Observed output:

<script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "A Blog",
    "url": "https://example.com"
  }
</script>

Expected behavior: JSON-LD emitted by EmDashHead should be compatible with Astro CSP, either by rendering in a way Astro can hash, using Astro's CSP APIs, or exposing a way for sites to render/suppress JSON-LD themselves.

Steps to reproduce

Create an Astro/EmDash site with strict CSP enabled via security.csp.
Render EmDashHead in the base layout:

---
import { EmDashHead } from "emdash/ui";
---

<head>
  <EmDashHead page={pageCtx} />
</head>

Load a page that emits site/content JSON-LD.
See a CSP violation for the inline application/ld+json script.

Environment

emdash version: 0.22.0
Node.js version: v22.22.3
Runtime: Cloudflare Workers
OS: macOS

Logs / error output

Executing inline script violates the following Content Security Policy directive 'script-src ...'. Either the 'unsafe-inline' keyword, a hash, or a nonce is required to enable inline execution. The action has been blocked.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

EmDashHead JSON-LD scripts are injected via HTML string and are not CSP-hashed #1782

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

EmDashHead JSON-LD scripts are injected via HTML string and are not CSP-hashed #1782

Uh oh!

khoinguyenpham04 Jul 3, 2026 Maintainer

Original Issue

Description

Steps to reproduce

Environment

Logs / error output

Replies: 0 comments

khoinguyenpham04
Jul 3, 2026
Maintainer