Skip to content

Conversation

@danielmorell
Copy link
Collaborator

@danielmorell danielmorell commented Nov 7, 2025

Description of the change

Adding a nonce attribute for inline frontend JS scripts is important for CSP policy. Previously there was no way to add a nonce attribute to the frontend error monitoring JS script. This resolves that issue by adding a filter.

A user can provide the nonce by registering a filter.

function my_nonce_method(string|null $nonce): string|null
{
    return 'foo'; // Return the nonce value here.
}
add_filter('rollbar_js_nonce', my_nonce_method(...));

// Or in the traditional syntax...
add_filter('rollbar_js_nonce', 'my_nonce_method');

Unfortunately, because WordPress has no standard way to set a nonce attibute we can't provide a default value.

Type of change

  • New feature (non-breaking change that adds functionality)

Related issues

Checklists

Development

  • Lint rules pass locally
  • The code changed/added as part of this pull request has been covered with tests
  • All tests related to the changed code pass in development

Code review

  • This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
  • "Ready for review" label attached to the PR and reviewers assigned
  • Issue from task tracker has a link to this pull request
  • Changes have been reviewed by at least one other engineer

@danielmorell danielmorell added this to the 3.1.0 milestone Nov 7, 2025
@danielmorell danielmorell self-assigned this Nov 7, 2025
@danielmorell danielmorell changed the title Ddded option to configure a nonce on the frontend JS script attribute. Added option to configure a nonce on the frontend JS script attribute. Nov 7, 2025
@danielmorell danielmorell requested a review from brianr November 7, 2025 17:56
@danielmorell danielmorell merged commit 7b1af3b into master Nov 7, 2025
24 checks passed
@danielmorell danielmorell deleted the fixed/issue-87-client-side-script-missing-nonce branch November 7, 2025 17:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add nonce attribute to client side script

3 participants