Skip to content

fix(start): apply nonce to generated client entry #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
birkskyum merged 1 commit into from
Aug 19, 2026
+23 −3
Merged

fix(start): apply nonce to generated client entry #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/client-entry-csp-nonce.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@solidjs/vite-plugin': patch
---

Apply the request CSP nonce to start mode's generated client-entry script.
10 changes: 10 additions & 0 deletions examples/turnkey/test/run.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -951,6 +951,16 @@ async function runProdMode() {
fetchableHtml.includes('SSR Start Mode') &&
!fetchableHtml.includes('provider-argument-must-not-be-forwarded'),
);
const nonceResponse = await builtHandler.handleRequest(new Request(origin + '/'), {
nonce: 'test"<&',
});
const nonceHtml = await nonceResponse.text();
record(
mode,
'build',
'client entry carries the escaped CSP nonce',
nonceHtml.includes('<script type="module" nonce="test&quot;&lt;&amp;" src="'),
);
record(
mode,
'build',
Expand Down
11 changes: 8 additions & 3 deletions src/ssr/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,7 +721,12 @@ export function startServe(
// every positional claim after it.
lines.push(
``,
`function createHtmlChunkTransform(clientEntry, extraHead) {`,
`function escapeAttribute(value) {`,
` return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');`,
`}`,
``,
`function createHtmlChunkTransform(clientEntry, extraHead, nonce) {`,
` const nonceAttr = nonce ? ' nonce="' + escapeAttribute(nonce) + '"' : '';`,
` let first = true;`,
` let injected = false;`,
` return (chunk) => {`,
Expand Down Expand Up @@ -767,7 +772,7 @@ export function startServe(
// fresh render-into-body mount (hydration, by contrast, wants to
// start as early as possible).
headParts.push(
`(clientEntry ? '<script type="module" src="' + clientEntry + '"${clientMode ? '' : ' async'}></' + 'script>' : '')`,
`(clientEntry ? '<script type="module"' + nonceAttr + ' src="' + clientEntry + '"${clientMode ? '' : ' async'}></' + 'script>' : '')`,
);
}
if (headParts.length) {
Expand Down Expand Up @@ -851,7 +856,7 @@ export function startServe(
` return createSSRResponse(result, event, {`,
` responseInit: options.responseInit,`,
` nonce: options.nonce,`,
` transformChunk: createHtmlChunkTransform(clientEntry, options.devHead),`,
` transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, options.nonce),`,
` });`,
`}`,
``,
Expand Down
Loading