search

kirillplatonov / hotwire-livereload

Live reload gem for Hotwire Rails apps.
MIT License
483 stars 28 forks source link

Add nonce to javascipt tag to support strict content security policies #42

Closed murraybo closed 1 year ago

murraybo commented 1 year ago

In our project we are using a strict content security policy (CSP). This includes a script-src with nonce.

Therefore all scripts include inside a page need to use this nonce on their tag.

Rails has build in support for this, but it needs to be used.

This pull request adds nonce: true to javascript_include_tag . If no CSP is configure this does not have any effect.

murraybo commented 1 year ago

The failed CI run looks unrelated to the change. Maybe something with the workflow definition, or maybe a rerun can help.

kirillplatonov commented 1 year ago

Yeah, it seems to be a global Github Actions issue today. I will restart it

kirillplatonov commented 1 year ago

Thank you for the contribution! 🙌

murraybo commented 1 year ago

Thank you for the fast merge and for your tool. It make my life easier every day. :-)