Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Streaming disables CSP silently #11801

Closed
vegardok opened this issue Feb 5, 2024 · 1 comment · Fixed by #12418
Closed

Streaming disables CSP silently #11801

vegardok opened this issue Feb 5, 2024 · 1 comment · Fixed by #12418
Labels
bug Something isn't working
Milestone
soon

Comments

@vegardok
Copy link

vegardok commented Feb 5, 2024

Describe the bug

Using streaming disables the "built in" CSP support and this is not documented clearly (reading both the CSP and streaming doc). The workaround is to use my own CSP in a handle hook, but to support streaming I have to add script-src: 'unsafe-inline' which is undesirable. I was not able to find the nonce in the handle hook that is referenced in the doc.

Reproduction

https://github.com/vegardok/sveltekit-csp-and-streaming/commits/main/

Logs

No response

System Info

System:
    OS: macOS 14.3
    CPU: (10) arm64 Apple M2 Pro
    Memory: 295.05 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 20.9.0 - ~/.nvm/versions/node/v20.9.0/bin/node
    npm: 10.1.0 - ~/.nvm/versions/node/v20.9.0/bin/npm
    pnpm: 8.14.0 - ~/.nvm/versions/node/v20.9.0/bin/pnpm
  Browsers:
    Chrome: 121.0.6167.85
    Safari: 17.3
  npmPackages:
    @sveltejs/adapter-auto: ^3.0.0 => 3.1.1 
    @sveltejs/kit: ^2.0.0 => 2.5.0 
    @sveltejs/vite-plugin-svelte: ^3.0.0 => 3.0.2 
    svelte: ^4.2.7 => 4.2.9 
    vite: ^5.0.3 => 5.0.12

Severity

serious, but I can work around it

Additional Information

No response
@jamesbirtles
Copy link

jamesbirtles commented Apr 4, 2024 •
edited
Loading

Pretty sure i just ran into this too, looking at the code generated (at least for the cloudflare adapter) it doesn't use the headers object that it adds the csp header (among other things) to

Here the headers22 variable has the csp header in but doesn't get used as !chunks is evaluating to false and they aren't used in the else branch.
CleanShot 2024-04-04 at 07 42 14@2x

0x221A added a commit to 0x221A/kit that referenced this issue Jun 29, 2024
@0x221A
fix: html response missing csp and link headers when return promise (s…
a945822 
…veltejs#11801)
0x221A added a commit to 0x221A/kit that referenced this issue Jun 29, 2024
@0x221A
fix: page response missing CSP and Link headers when return promise i…
72e9e96 
…n `load` (sveltejs#11801)
0x221A added a commit to 0x221A/kit that referenced this issue Jun 29, 2024
@0x221A
fix: page response missing CSP and Link headers when return promise i…
50a9906 
…n `load` (sveltejs#11801)
@0x221A 0x221A mentioned this issue Jun 29, 2024
Merged
6 tasks
0x221A added a commit to 0x221A/kit that referenced this issue Jun 30, 2024
@0x221A
fix: page response missing CSP and Link headers when return promise i…
e4c1ffa 
…n `load` (sveltejs#11801)
@eltigerchino eltigerchino added the bug Something isn't working label Oct 10, 2024
@eltigerchino eltigerchino added this to the soon milestone Oct 10, 2024
eltigerchino pushed a commit that referenced this issue Oct 10, 2024
@0x221A
fix: page response missing CSP and Link headers when return promise i…
6f9aefd 
…n `load` (#12418)

* fix: page response missing CSP and Link headers when return promise in `load` (#11801)

* fix: add nonce in stream data part

* test: ensure CSP header in stream response
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
soon
Development

Successfully merging a pull request may close this issue.

fix: page response missing CSP and Link headers when return promise in load 0x221A/kit
3 participants
@vegardok @jamesbirtles @eltigerchino