-
-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Streaming disables CSP silently #11801
Comments
0x221A
added a commit
to 0x221A/kit
that referenced
this issue
Jun 29, 2024
0x221A
added a commit
to 0x221A/kit
that referenced
this issue
Jun 29, 2024
0x221A
added a commit
to 0x221A/kit
that referenced
this issue
Jun 29, 2024
6 tasks
0x221A
added a commit
to 0x221A/kit
that referenced
this issue
Jun 30, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Using streaming disables the "built in" CSP support and this is not documented clearly (reading both the CSP and streaming doc). The workaround is to use my own CSP in a handle hook, but to support streaming I have to add
script-src: 'unsafe-inline'
which is undesirable. I was not able to find the nonce in the handle hook that is referenced in the doc.Reproduction
https://github.com/vegardok/sveltekit-csp-and-streaming/commits/main/
Logs
No response
System Info
Severity
serious, but I can work around it
Additional Information
No response
The text was updated successfully, but these errors were encountered: