diff --git a/package.json b/package.json index a94f13c5..836cc7b4 100644 --- a/package.json +++ b/package.json @@ -67,8 +67,8 @@ "@types/node": "^18.18.1", "eslint": "^8.50.0", "nuxt": "^3.11.2", - "vitest": "^1.3.1", - "typescript": "^5.4.5" + "typescript": "^5.4.5", + "vitest": "^1.3.1" }, "stackblitz": { "installDependencies": false, diff --git a/playground/components/ServerComponent.server.vue b/playground/components/ServerComponent.server.vue new file mode 100644 index 00000000..7b5b5900 --- /dev/null +++ b/playground/components/ServerComponent.server.vue @@ -0,0 +1,3 @@ + \ No newline at end of file diff --git a/playground/pages/island.vue b/playground/pages/island.vue new file mode 100644 index 00000000..9f18b75e --- /dev/null +++ b/playground/pages/island.vue @@ -0,0 +1,6 @@ + \ No newline at end of file diff --git a/src/runtime/nitro/plugins/50-updateCsp.ts b/src/runtime/nitro/plugins/50-updateCsp.ts index 17cc7aa1..34c948c6 100644 --- a/src/runtime/nitro/plugins/50-updateCsp.ts +++ b/src/runtime/nitro/plugins/50-updateCsp.ts @@ -7,16 +7,18 @@ import type { ContentSecurityPolicyValue } from '../../../types/headers' */ export default defineNitroPlugin((nitroApp) => { nitroApp.hooks.hook('render:html', (response, { event }) => { - const rules = resolveSecurityRules(event) - if (rules.enabled && rules.headers) { - const headers = rules.headers - - if (headers.contentSecurityPolicy) { - const csp = headers.contentSecurityPolicy - const nonce = event.context.security?.nonce - const scriptHashes = event.context.security?.hashes?.script - const styleHashes = event.context.security?.hashes?.style - headers.contentSecurityPolicy = updateCspVariables(csp, nonce, scriptHashes, styleHashes) + if (!response.island) { + const rules = resolveSecurityRules(event) + if (rules.enabled && rules.headers) { + const headers = rules.headers + + if (headers.contentSecurityPolicy) { + const csp = headers.contentSecurityPolicy + const nonce = event.context.security?.nonce + const scriptHashes = event.context.security?.hashes?.script + const styleHashes = event.context.security?.hashes?.style + headers.contentSecurityPolicy = updateCspVariables(csp, nonce, scriptHashes, styleHashes) + } } } }) diff --git a/src/runtime/nitro/plugins/60-recombineHtml.ts b/src/runtime/nitro/plugins/60-recombineHtml.ts index a7f4ed01..6cc082a3 100644 --- a/src/runtime/nitro/plugins/60-recombineHtml.ts +++ b/src/runtime/nitro/plugins/60-recombineHtml.ts @@ -24,11 +24,13 @@ export default defineNitroPlugin((nitroApp) => { // Let's insert the CSP meta tag just after the first tag which should be the charset meta let insertIndex = 0 - const metaCharsetMatch = html.head[0].match(/^/mdi) - if (metaCharsetMatch && metaCharsetMatch.indices) { - insertIndex = metaCharsetMatch.indices[0][1] + if (html.head.length > 0) { + const metaCharsetMatch = html.head[0].match(/^/mdi) + if (metaCharsetMatch && metaCharsetMatch.indices) { + insertIndex = metaCharsetMatch.indices[0][1] + } + html.head[0] = html.head[0].slice(0, insertIndex) + `` + html.head[0].slice(insertIndex) } - html.head[0] = html.head[0].slice(0, insertIndex) + `` + html.head[0].slice(insertIndex) } }) }) \ No newline at end of file