4 people 7458ffa042 Support adding CSP nonce with content-security-policy-report-only header (#59071) ...

**Note**: this is a 1-to-1 copy of #48969 by @danieltott with all the
merge conflicts fixed.

## Checklist

* Fixes https://github.com/vercel/next.js/issues/48966
* Tests added to
`test/production/app-dir/subresource-integrity/subresource-integrity.test.ts`

## Description

Currently `renderToHTMLOrFlight` in app-render pulls out a nonce value
from a `content-security-policy` header for use in generating script
tags:


https://github.com/vercel/next.js/blob/e7c9d3c051e6027cf187e0d70565417d6037e37c/packages/next/src/server/app-render/app-render.tsx#L1204

That misses the ability to use a [content-security-policy-report-only
header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only).
Many times this is a required step to enabling a CSP - by shipping a CSP
with report-only and collecting reports before actually blocking
resources.

## Changes

* Added ability to check `content-security-policy-report-only` header in
`renderToHTMLOrFlight()`
* Added test to verify `nonce` is correctly applied when
`content-security-policy-report-only` header exists

Co-authored-by: Dan Ott <[email protected]>
Co-authored-by: Zack Tanner <[email protected]>

2023-11-30 19:40:57 -08:00

..

fixture

Move SRI test into separate suite (#56015)

2023-09-26 15:34:34 +02:00

subresource-integrity.test.ts

Support adding CSP nonce with content-security-policy-report-only header (#59071)

2023-11-30 19:40:57 -08:00