Put CSP in to headers and not Meta tags

2025-04-14 15:00:14 +01:00
parent 6543161bad
commit 8f9652003e
4 changed files with 92 additions and 6 deletions
@@ -28,14 +28,20 @@ class MyDocument extends Document {
            path: "/",
        });

-        return { ...initialProps, useGATracking, cookieObj };
+        const headers = ctx.req?.headers;
+        const generatedNonce = headers?.["x-nonce"];
+
+        return { ...initialProps, useGATracking, cookieObj, generatedNonce };
    }

    render() {
        const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null;
        const { useGATracking, locale, cookieObj } = this.props;

-        const generatedNonce = nanoid();
+        //const generatedNonce = nanoid();
+        const generatedNonce = this.props.generatedNonce;
+
+        console.log("this is the nonce:", generatedNonce);

        let csp = ``;
        csp += `base-uri 'self';`;
@@ -51,7 +57,7 @@ class MyDocument extends Document {
        return (
            <Html lang={locale}>
                <Head nonce={generatedNonce}>
-                    <meta httpEquiv="Content-Security-Policy" content={csp} />
+                    {/* <meta httpEquiv="Content-Security-Policy" content={csp} /> */}
                    {useGATracking && (
                        <Tracking
                            googleTagManagerID={"G-GTWW3JT03Z"}