fix(csp): ensure-plugins-last #271
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Now that the TS config is compliant, we can - remove @ts-ignore overrides - import from "#imports" instead of importing from dependencies
- no need to import NitroAppPlugin from 'nitropack' - rename 'nitro' variable to 'nitroApp' for clarity
This reverts commit e751f52.
- conform eslint to standard recommendation - fix "template root requires one element" in secret.vue - also conforms 'npm run dev' script setup
- add .nuxtrc autoImport directive in docs/ - enables building outside of root directory
- put our security plugins last - allows to insert nonces after all external scripts have been inserted
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Baroshem
approved these changes
Oct 30, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Types of changes
Description
This PR ensures that the Nitro Plugins installed by Nuxt Security will run last in order.
It is important for CSP nonces to be injected in the final html only after third-party modules have finished running first.
Background: When a Nuxt application uses several third-party modules, these third-party modules sometimes inject script tags. If they run after us, our nonces will not be injected in such script tags and this will result in a CSP denial, preventing the application to render.
Checklist: