Incompatibility with inlineScriptNonce and useTemplateFragments

[summersz]

When setting useTemplateFragments to true whilst using inlineScriptNonce, Chrome logs a csp error for any inline scripts returned in the response. Interestingly it does actually execute them after the errors are logged, so the only issue is the console log getting spammed.

No errors are logged in Firefox.

[andryyy]

I think the stuff you add with templates is not known by HTMX and the nonce will therefore be missing.

Can you check the source code for this?

[summersz]

The parsed html is inserted before the scripts get processed. On processing a new script element, with the nonce from the inlineScriptNonce setting added, gets inserted and then the old script gets removed. Chrome flags the csp error when inserting the original document fragment but that then gets replaced with an acceptable inline script, which explains why everything still works. Not sure why Chrome flags this with fragments and not elements. As a dirty hack I am adding the nonce to the html string prior to the html parsing.