Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CSP test when using Turbopack #56833

Merged
merged 3 commits into from Oct 14, 2023
Merged

Fix CSP test when using Turbopack #56833

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d53a4d7
Fix CSP test when using Turbopack
timneutkens Oct 14, 2023
3bbbb77
Merge branch 'canary' into 10-14-Fix_CSP_test_when_using_Turbopack
huozhi Oct 14, 2023
62697fb
Merge branch 'canary' into 10-14-Fix_CSP_test_when_using_Turbopack
timneutkens Oct 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
18 changes: 10 additions & 8 deletions test/e2e/app-dir/app/index.test.ts
View file
Open in desktop
Expand Up @@ -1827,7 +1827,10 @@ createNextDescribe(
expect($('body').find('script[async]').length).toBe(1)
})

if (!isDev) {
// Turbopack doesn't use eval by default, so we can check strict CSP.
if (!isDev || isTurbopack) {
// This test is here to ensure that we don't accidentally turn CSP off
// for the prod version.
it('should successfully bootstrap even when using CSP', async () => {
// This path has a nonce applied in middleware
const browser = await next.browser('/bootstrap/with-nonce')
Expand All @@ -1844,19 +1847,18 @@ createNextDescribe(
})
} else {
it('should fail to bootstrap when using CSP in Dev due to eval', async () => {
// This test is here to ensure that we don't accidentally turn CSP off
// for the prod version.
const browser = await next.browser('/bootstrap/with-nonce')
const response = await next.fetch('/bootstrap/with-nonce')
// We expect this page to response with CSP headers requiring a nonce for scripts
expect(response.headers.get('content-security-policy')).toContain(
"script-src 'nonce"
)
// We expect our app to fail to bootstrap due to invalid eval use in Dev.
// We assert the html is in it's SSR'd state.
expect(
await browser.eval('document.getElementById("val").textContent')
).toBe('initial')

const response = await next.fetch('/bootstrap/with-nonce')
// We expect this page to response with CSP headers requiring a nonce for scripts
expect(response.headers.get('content-security-policy')).toContain(
"script-src 'nonce"
)
})
}
})
Expand Down