-
-
Notifications
You must be signed in to change notification settings - Fork 138
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Extract initialState
to asset to respect CSP
#67
base: main
Are you sure you want to change the base?
feat: Extract initialState
to asset to respect CSP
#67
Conversation
There are some problem need to be resolved with this solution
So, I would think this external them as scripts might not be a very good solution. A few ideas:
|
…-csp-for-initial-state
@antfu Sorry it took so long to answer. I had a lot on my plate. I agree I have not though about these complications. It definitely makes sense to not use the initial state if it is empty. However, wouldn't it be fine to issue a network request for an |
772717e
to
c4f5b63
Compare
@antfu The On line 91 we should remove // line 91
const { routes/*, initialState*/ } = await createApp(false) // <= `initialState` should be removed // line 121
const { app, router, head, initialState } = await createApp(false, route) // <= `initialState` should be added |
I don't know if you're fixing it and I don't want to bother you, I added this comment a few days ago: #72 (comment) |
@pantajoe Can you test with those little changes on local? |
@userquin Yeah, I'll test it and let you know if it solves the issue in the comment you linked. |
It's no longer required to use a router hook to initialize the initialState
as of version 2.0.0
@antfu Sorry for the spam, but on second thought, I believe we can utilize this feature as the @userquin What do you think about this? |
I have raised a separate pr #108 to resolve #72. It solves my issues and will help here as well. Thanks @userquin for the proposed fix
|
This PR extracts the
initialState
(#42) to an asset file at build time and, thus, avoids an inline script.For that reason, it now respects the default of CSP where no inline scripts are allowed.
Closes #49.