search

nibtime / next-safe-middleware

Strict CSP (Content-Security-Policy) for Next.js hybrid apps https://web.dev/strict-csp/
https://next-safe-middleware.vercel.app
MIT License
78 stars 20 forks source link

Pass in arbitrary script hashes? #81

Open fymmot opened 1 year ago

fymmot commented 1 year ago

Hi! I am using next-themes for darkmode functionality on my site, which is inserting a script block into the <body>.

This block isn't trustified by next-safe-middleware and causing a CSP error. I was wondering if it is possible to hash it manually and pass the hash to the CSP policy somehow?

I tried creating a script-src directive and adding the hash, but the policy appears to be overwritten when the site is deployed:

'script-src': [
        'self',
        'sha256-eMuh8xiwcX72rRYNAGENurQBAcH7kLlAUQcoOri3BIo=',
      ],

Is there a way to achieve this? (Apologies in advance if I have missed something obvious)