[Fizz] Support nonce option to be passed to inline scripts #22593
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
facebook-github-bot
added
CLA Signed
React Core Team
|
Comparing: 34e4c97...f4f890f Critical size changesIncludes critical production bundles, as well as any change greater than 2%:
Significant size changesIncludes any change greater than 0.2%: Expand to show
|
acdlite
approved these changes
Oct 20, 2021
sebmarkbage
changed the title
KamranAsif
pushed a commit
to KamranAsif/react
that referenced
this pull request
Nov 4, 2021
zhengjitf
pushed a commit
to zhengjitf/react
that referenced
this pull request
Apr 15, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fizz currently generates inline scripts. If you have a Content Security Policy that blocks it, you need to provide a
nonceattribute to it to allow those scripts. This just adds an option to pass through such an attribute.However, a better strategy is probably that we expose an external script that can be loaded onto the page early through a
srcwith a mutation observer that detects segments that we've inserted and runs the appropriate commands. That way we don't need to use inline scripts for this. It's also closer to what we want the ideal built-in feature for this in the DOM would look like so it'd be more of a polyfill.However, it might still be better to use inline scripts for the cases where it is allowed and you haven't already loaded the script into cache. Also, if you already have a nonce anyway it might be better.