Skip to content

Conversation

@SimenB
Copy link

@SimenB SimenB commented Apr 10, 2025

These can be overridden by consumers to add e.g. nonce.

In our config/resque.rb I've added the following

module Resque
  module ServerHelper
    def script_tag(src)
      base = "<script src=\"#{url_path(src)}\" type=\"text/javascript\"></script>"

      request = ActionDispatch::Request.new(env)

      nonce = request.content_security_policy_nonce

      return base unless nonce

      base.gsub(/><\/script>$/, " nonce=\"#{nonce}\"></script>")
    end

    def link_tag(src)
      base = "<link href=\"#{url_path(src)}\" media=\"screen\" rel=\"stylesheet\" type=\"text/css\">"

      request = ActionDispatch::Request.new(env)

      nonce = request.content_security_policy_nonce

      return base unless nonce

      base.gsub(/">$/, "\" nonce=\"#{nonce}\">")
    end
  end
end

And with that, the CSP errors are gone 🥳

image

(Note that I am by no means a ruby/rails/sinatra/rack expert, but this works. Happy to change approach if there are better ways to go about this. I'd like to avoid having to maintain a fork, tho)

Fixes #1897

These can be overridden by consumers to add e.g. `nonce`
Copy link
Contributor

@PatrickTulskie PatrickTulskie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is okay. Just two formatting suggestions to make things a little easier to read.

If you can update your PR in the next day, I should be able to sneak this into 3.0.

SimenB and others added 2 commits November 29, 2025 23:17
@SimenB
Copy link
Author

SimenB commented Dec 23, 2025

@PatrickTulskie I updated btw - dunno if an email fires when I accept suggestions 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Overview UI Broken Due to Nonce Whitelist

2 participants