Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for FUOC prevention script generation as string for injection in hooks.server.ts #92

Closed
fnimick opened this issue Aug 9, 2024 · 4 comments
Labels
enhancement New feature or request

Comments

@fnimick
Copy link
Contributor

fnimick commented Aug 9, 2024

Describe the feature in detail (code, mocks, or screenshots encouraged)

Per Svelte team, a potential way to handle adding library scripts to the initial page load <head> is to add a script block with nonce="%sveltekit.nonce%" in your app.html, then inject the library content into that script block in a server hook for rendering. This would avoid the need to manually manipulate CSP response headers to keep a generated nonce in sync with the mode watcher nonce prop, as suggested in #86

It would be great to provide a function that would generate and return the script content as a string for use in such a way. (and also add a prop to disable the addition of the FOUC prevention script in svelte:head in this case, since it will already be added through a hook)

What type of pull request would this be?

Enhancement

Provide relevant links or additional information.

I already took a first pass at this in #89

@fnimick fnimick added the enhancement New feature or request label Aug 9, 2024
@jasongitmail
Copy link

Great find! This might solve the issue of SvelteKit's CSP rules clobbering mode-watcher's inline hash. I've had to choose between living with FOUC or disabling script-src rules (security issue) due to this.

@fnimick
Copy link
Contributor Author

fnimick commented Aug 13, 2024

Usage example in hooks.server.ts:

const injectHeadScripts: Handle = async ({ event, resolve }) => {
  return resolve(event, {
    transformPageChunk: ({ html }) => {
      return html.replace("%modewatcher.snippet%", generateSetInitialModeExpression({}));
    },
  });
};

export const handle = sequence(
  injectHeadScripts,
  // .....
);

@ithan
Copy link

ithan commented Nov 13, 2024

Hello guys! I see that @fnimick made a pull request for this ( #89 ) and I'm wondering if there is any ETA for a release?

I'm having this issue as well, and I don't want to disable the script-src rule 😞

@huntabyte
Copy link
Member

Working on it! Testing some ideas around a ModeWatcherLite which would omit the script tag and then provide helpers for handling it in the hook!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants