Nonces not allowed in inline <script> tags

tomciopp · April 13, 2019, 9:27pm

I’ve written up a bug report here, but does anyone have any idea why this might happen?

github.com/phoenixframework/phoenix_html

Bug: Nonce not allowed on script tags?

opened 09:22PM - 13 Apr 19 UTC

closed 09:49PM - 13 Apr 19 UTC

So this is a weird issue, I'm trying to modify my inline script tags to add nonc…es to comply with a stricter CSP but I'm running into a weird issue where the value is stripped before rendered to the page. If I add the following code in a template ` <script type="text/javascript" nonce="1234">` It renders ```javascript <script type="text/javascript" nonce> ``` If I change the attribute name from 'nonce' to 'foo' it renders ```javascript <script type="text/javascript" foo="1234"> ``` This is surprising because the application is not behaving how I am telling it to, and it is not obvious why the value is being stripped. I'm unsure if this is a bug or feature and if it is a feature how can it be overridden.

LostKobrakai · April 13, 2019, 9:37pm

Phoenix does not change the text you put into templates at all, so I’m wondering if what you’re seeing is not browser behaviour.

tomciopp · April 14, 2019, 12:21am

Yeah this seems to be a browser issue that is only affecting Chrome. Will have to dig deeper.