How do you pass a nonce to pages scripts? #5724

PlopTheReal · 2022-07-27T09:28:49Z

PlopTheReal
Jul 27, 2022

Using a node adapter I generate the CSP directives with helmet within the HTTP headers (known as more secure)
As I'm using 'strict-dynamic' I have to pass the nonce to the scripts tags.
How can you do so with Sveltekit?

server.js

...
 app.use((req, res, next) =>
    {
        res.locals = { nonce: nanoid(10) } // generate a nonce to pass it to helmet
        helmet.contentSecurityPolicy({
            directives: {
                defaultSrc: ["'none'"],
                 ....
                scriptSrc: [(req, res) => `'nonce-${res.locals.nonce}' 'strict-dynamic' 'unsafe-inline' https: http:`]
            }
        })(req, res, next) 
    })
...

Coming from Nextjs they provid such mechanism like the following:

_document.js

...
export default class MyDocument extends Document {
    render() {
        const pageProps = this.props.__NEXT_DATA__.props.pageProps
        const nonce = pageProps.nonce
        return (
            <Htm>
                <Head nonce={nonce} >
                </Head>
                <body>
                    <Main />
                    <NextScript nonce={nonce} />
                </body>
            </Html>
        );
    }
}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

How do you pass a nonce to pages scripts? #5724

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

How do you pass a nonce to pages scripts? #5724

Uh oh!

Uh oh!

PlopTheReal Jul 27, 2022

Replies: 0 comments

PlopTheReal
Jul 27, 2022