Fingerprinting and SRI ordering issue

[onedrawingperday]

It seems that to generate the SHA value for an inline script we need to wrap it within a {{ if $secureJS.Content }}{{ end }} before accessing the integrity.

Also see related Forum topic: https://discourse.gohugo.io/t/generate-inline-script-sha-for-content-security-policy/14627

[bep]

I will fix this, but note that in the original problem case, adding MIME type to the script would also work:

<script type="{{ $secureJS.MediaType }}" integrity="{{ $secureJS.Data.Integrity }}">{{ $secureJS.Content | safeJS }}</script>

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.