Added nonce to prerender script output to support CSP #761

New Issue

fergalmoran · 2025-08-09T17:17:34Z

fergalmoran commented

2025-08-09 17:17:34 +00:00

Originally created by @nilsgs on 5/15/2017

Currently we need to use script-src 'unsafe-inline' in the Content Security Policy header to get access to the global js object added to the page by the prerenderer.

I've added an optional asp-prerender-nonce attribute, to overcome this limitation.

*Originally created by @nilsgs on 5/15/2017* Currently we need to use `script-src 'unsafe-inline'` in the Content Security Policy header to get access to the global js object added to the page by the prerenderer. I've added an optional `asp-prerender-nonce` attribute, to overcome this limitation.

fergalmoran closed this issue

2025-08-09 17:17:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/JavaScriptServices#761