Skip to content

fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary - #5430

Merged
yusukebe merged 1 commit into
honojs:mainfrom
koreahghg:fix/error-boundary-script-nonce
Nov 4, 2026
Merged

yusukebe merged 1 commit into
honojs:mainfrom
koreahghg:fix/error-boundary-script-nonce

Conversation

@koreahghg

Copy link
Copy Markdown
Contributor

#4216 added scriptNonce support via StreamingContext, but two of the three inline scripts ErrorBoundary emits while streaming were left without the nonce:

  • the script that swaps in the fallback when a child rejects during streaming
  • the cleanup script emitted after all nested Suspense boundaries resolve

Under a nonce-based CSP these scripts are blocked, so the fallback is never shown and the boundary markers are never removed.

renderToReadableStream(
  <StreamingContext value={{ scriptNonce: 'n0nce' }}>
    <ErrorBoundary fallback={<p>error</p>}>
      <Suspense fallback={<p>Loading...</p>}>
        <AsyncComponentThatThrows />
      </Suspense>
    </ErrorBoundary>
  </StreamingContext>
)
// before: the fallback is emitted with a plain `<script>`
// after:  `<script nonce="n0nce">`

The existing "with StreamingContext" test was asserting the nonce-less cleanup script; it now expects the nonce, and a test for the error path is added. Both tests fail without this change.

Related: #4205, #4216.

The author should do the following, if applicable

  • Add tests
  • Run tests
  • bun run format:fix && bun run lint:fix to format the code
  • Add TSDoc/JSDoc to document the code

honojs#4216 added `scriptNonce` support via `StreamingContext`, but two of the
three inline scripts ErrorBoundary emits while streaming were left without
the nonce:

- the script that swaps in the fallback when a child rejects during streaming
- the cleanup script emitted after all nested Suspense boundaries resolve

Under a nonce-based CSP these scripts are blocked, so the fallback is never
shown and the boundary markers are never removed.

The existing "with StreamingContext" test was asserting the nonce-less
cleanup script; it now expects the nonce, and a test for the error path is
added.
@yusukebe
yusukebe merged commit bcfd02b into honojs:main Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants