mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
ceeef26fd4
Turbolinks replaces the CSP nonce <meta> tag on page change, but inline scripts inserted by UJS need the nonce from the initial page load. In general, it doesn't matter to UJS if the nonce changes after the page loads: only the initial value is relevant.
8 lines
220 B
CoffeeScript
8 lines
220 B
CoffeeScript
nonce = null
|
|
|
|
Rails.loadCSPNonce = ->
|
|
nonce = document.querySelector("meta[name=csp-nonce]")?.content
|
|
|
|
# Returns the Content-Security-Policy nonce for inline scripts.
|
|
Rails.cspNonce = ->
|
|
nonce ? Rails.loadCSPNonce()
|