feat: add support for nonce#10
feat: add support for nonce#10DylanPiercey merged 6 commits intomarko-js:mainfrom snyamathi:cspNonce
Conversation
🦋 Changeset detectedLatest commit: 6043795 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
| (this.getHeader("Content-Type") as string | undefined)?.startsWith( | ||
| "text/html" | ||
| ) | ||
| export function createRedirectWithMidstreamSupportFn({ cspNonce }: { cspNonce?: string; } = {}) { |
There was a problem hiding this comment.
Adds a wrapper to the function so we can inject the csp nonce
| return redirectWithMidstreamSupport; | ||
| } | ||
|
|
||
| export const redirectWithMidstreamSupport = createRedirectWithMidstreamSupportFn(); |
There was a problem hiding this comment.
Default export to maintain backward compatibility and avoid having to re-create the function each request unless a nonce is given.
Codecov ReportBase: 100.00% // Head: 100.00% // No change to project coverage 👍
Additional details and impacted files@@ Coverage Diff @@
## main #10 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 7 7
Lines 53 58 +5
Branches 13 16 +3
=========================================
+ Hits 53 58 +5
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
|
@snyamathi thanks for the reminder and the PR. I went ahead and improved/simplified a few things and will get out the patch shortly 😄 (Note: there's something wrong with the format script in the CLI, I went ahead and ensured the formatting was good) |
|
Got it - yeah I like the approach using a symbol to store the cspNonce on the res object - LGTM and much easier. |
|
Awesome. I'm just working to figure out what's wrong with the |
|
Seems like github just doesn't like having a commit action from a fork so 🤷. Thanks again for the PR, just going to go ahead and merge! |
2 participants
This PR adds a CSP nonce if given in
$global. fixes: #8Description
The midstream redirect script should include a CSP nonce if one exists in
$globalSince we don't have a handle to
$globalin the redirect function, I can't really think of a better way to add the nonce in without eitherres.redirect(not ideal)reqorreswhich might break othersMotivation and Context
We need a CSP Nonce for our security settings
Screenshots (if appropriate):
Checklist:
cc @DylanPiercey
I signed the CLA but still showing an error