[PR #795] [MERGED] feat: csp support #853

New issue

Closed

opened 2026-05-06 13:10:28 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:28 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/795
Author: @hyoban
Created: 4/8/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @james-elicx

Base: main ← Head: 4-8-fix-csp

📝 Commits (10+)

b7b7724 fix: support csp
f463733 tweaks
b8eaa07 tweaks
cec884a tweaks
2750bd4 tweaks
432e2e3 tweaks
e32d366 tweaks
71aaf0f clean
0bb65e6 tweaks
8d1ea23 clean

📊 Changes

40 files changed (+1885 additions, -615 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+47 -18)
📝 packages/vinext/src/entries/pages-server-entry.ts (+205 -199)
📝 packages/vinext/src/server/app-page-boundary-render.ts (+2 -0)
📝 packages/vinext/src/server/app-page-render.ts (+3 -0)
📝 packages/vinext/src/server/app-page-response.ts (+8 -0)
📝 packages/vinext/src/server/app-page-stream.ts (+6 -0)
📝 packages/vinext/src/server/app-ssr-entry.ts (+31 -21)
📝 packages/vinext/src/server/app-ssr-stream.ts (+9 -6)
➕ packages/vinext/src/server/csp.ts (+104 -0)
📝 packages/vinext/src/server/dev-server.ts (+46 -30)
📝 packages/vinext/src/server/html.ts (+16 -0)
📝 packages/vinext/src/server/pages-page-data.ts (+6 -2)
📝 packages/vinext/src/server/pages-page-response.ts (+40 -13)
📝 packages/vinext/src/server/prod-server.ts (+16 -3)
➕ packages/vinext/src/shims/script-nonce-context.tsx (+23 -0)
📝 packages/vinext/src/shims/script.tsx (+96 -13)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+480 -307)
📝 tests/app-page-render.test.ts (+17 -0)
📝 tests/app-page-response.test.ts (+24 -0)
📝 tests/app-router.test.ts (+24 -0)

...and 20 more files

📄 Description

Currently, inline scripts are being blocked by CSP.

self.__VINEXT_RSC_PARAMS__={}
self.__VINEXT_RSC_NAV__=...
self.__VINEXT_RSC_CHUNKS__.push(...)
self.__VINEXT_RSC_DONE__=true

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/795 **Author:** [@hyoban](https://github.com/hyoban) **Created:** 4/8/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `4-8-fix-csp` --- ### 📝 Commits (10+) - [`b7b7724`](https://github.com/cloudflare/vinext/commit/b7b7724a50cd359408087f1415d1f783e052d807) fix: support csp - [`f463733`](https://github.com/cloudflare/vinext/commit/f46373384be92163a912475a784041163f47dadf) tweaks - [`b8eaa07`](https://github.com/cloudflare/vinext/commit/b8eaa0733383ff9c78310dfbda5899d4a54093b9) tweaks - [`cec884a`](https://github.com/cloudflare/vinext/commit/cec884afc5aaf5ffc8f4e8876438dd467cb2c524) tweaks - [`2750bd4`](https://github.com/cloudflare/vinext/commit/2750bd4a41f6f9a163afa62c4acc3289927cf56e) tweaks - [`432e2e3`](https://github.com/cloudflare/vinext/commit/432e2e3c06191164393ef1ff5c94f2df407655d5) tweaks - [`e32d366`](https://github.com/cloudflare/vinext/commit/e32d366f6b4993d137ad110b808c6f8d0002da5a) tweaks - [`71aaf0f`](https://github.com/cloudflare/vinext/commit/71aaf0f23da2deac52dccd57ee27853ce188698c) clean - [`0bb65e6`](https://github.com/cloudflare/vinext/commit/0bb65e6ccb39a9c6fa0fea3dd4120ffb19e53c1a) tweaks - [`8d1ea23`](https://github.com/cloudflare/vinext/commit/8d1ea231243c464b6328ad339fc1c29a5e852bae) clean ### 📊 Changes **40 files changed** (+1885 additions, -615 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+47 -18) 📝 `packages/vinext/src/entries/pages-server-entry.ts` (+205 -199) 📝 `packages/vinext/src/server/app-page-boundary-render.ts` (+2 -0) 📝 `packages/vinext/src/server/app-page-render.ts` (+3 -0) 📝 `packages/vinext/src/server/app-page-response.ts` (+8 -0) 📝 `packages/vinext/src/server/app-page-stream.ts` (+6 -0) 📝 `packages/vinext/src/server/app-ssr-entry.ts` (+31 -21) 📝 `packages/vinext/src/server/app-ssr-stream.ts` (+9 -6) ➕ `packages/vinext/src/server/csp.ts` (+104 -0) 📝 `packages/vinext/src/server/dev-server.ts` (+46 -30) 📝 `packages/vinext/src/server/html.ts` (+16 -0) 📝 `packages/vinext/src/server/pages-page-data.ts` (+6 -2) 📝 `packages/vinext/src/server/pages-page-response.ts` (+40 -13) 📝 `packages/vinext/src/server/prod-server.ts` (+16 -3) ➕ `packages/vinext/src/shims/script-nonce-context.tsx` (+23 -0) 📝 `packages/vinext/src/shims/script.tsx` (+96 -13) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+480 -307) 📝 `tests/app-page-render.test.ts` (+17 -0) 📝 `tests/app-page-response.test.ts` (+24 -0) 📝 `tests/app-router.test.ts` (+24 -0) _...and 20 more files_ </details> ### 📄 Description Currently, inline scripts are being blocked by CSP. ``` self.__VINEXT_RSC_PARAMS__={} self.__VINEXT_RSC_NAV__=... self.__VINEXT_RSC_CHUNKS__.push(...) self.__VINEXT_RSC_DONE__=true ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>