build csp meta ourselves

mastercomfig · Jul 12, 2024 · a50f125 · a50f125
1 parent 5af2d6a
commit a50f125
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/astro.config.mts b/astro.config.mts
@@ -4,7 +4,7 @@ import { shield } from "@kindspells/astro-shield";
 import sentry from "@sentry/astro";
 import AstroPWA from "@vite-pwa/astro";
 import type { AstroIntegration } from "astro";
-import { defineConfig } from "astro/config";
+import { defineConfig, envField } from "astro/config";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import { resolve } from "node:path";
@@ -158,5 +158,14 @@ export default defineConfig({
     globalRoutePriority: true,
     contentCollectionCache: true,
     contentCollectionJsonSchema: true,
+    env: {
+      schema: {
+        NONCE: envField.string({
+          context: "server",
+          access: "secret",
+          default: nonce,
+        }),
+      },
+    },
   },
 });
diff --git a/src/layouts/Layout.astro b/src/layouts/Layout.astro
@@ -1,10 +1,14 @@
 ---
+import { getSecret } from "astro:env/server";
 
+const nonce = getSecret("NONCE");
 ---
 
 <html lang="en-US" data-bs-theme="dark" transition:animate="none">
   <slot />
 
+  <meta property="csp-nonce" nonce={nonce} />
+
   <script>
     const mediaQuery = window.matchMedia("(prefers-reduced-motion: reduce)");
     document.addEventListener("astro:page-load", () => {