Ajax: Avoid CSP errors in the script transport for async requests #4763
Conversation
|
I believe this is not a breaking change. Can we include it in 3.6.0? |
There was a problem hiding this comment.
One thing we do lose here is the ability to set XHR stuff like headers on a script request. I would definitely consider that a breaking change but since it's set for 4.0 it's fair game. At the moment though, there doesn't seem to be an easy way to get the old behavior back and use the old transport.
src/ajax/script.js
Outdated
|
|
||
| // These types of requests are handled via a script tag | ||
| // so force their methods to GET. | ||
| if ( s.async || s.crossDomain || s.scriptAttrs ) { |
There was a problem hiding this comment.
Did you optimize this order for gzip compression? If not, I suspect placing s.crossDomain first might chop off a byte or two.
There was a problem hiding this comment.
I checked various reorderings & what you propose (+ a few others) were the smallest. Smaller by... one byte compared to my original version. 😄
PR updated. +10 bytes now.
mgol
added
the
Discuss in Meeting
|
Adding the |
Until now, the AJAX script transport only used a script tag to load scripts for cross-domain requests or ones with `scriptAttrs` set. This commit makes it also used for all async requests to avoid CSP errors arising from usage of inline scripts. This also makes `jQuery.getScript` not trigger CSP errors as it uses the AJAX script transport under the hood. For sync requests such a change is impossible and that's what `jQuery._evalUrl` uses. Fixing that is tracked in jquerygh-1895. The commit also makes other type of requests using the script tag version of the script transport set its type to "GET", namely async scripts & ones with `scriptAttrs` set in addition to the existing cross-domain ones. Fixes jquerygh-3969
mgol
removed
Discuss in Meeting
Summary
Until now, the AJAX script transport only used a script tag to load scripts
for cross-domain requests or ones with
scriptAttrsset. This commit makesit also used for all async requests to avoid CSP errors arising from usage
of inline scripts. This also makes
jQuery.getScriptnot trigger CSP errorsas it uses the AJAX script transport under the hood.
For sync requests such a change is impossible and that's what
jQuery._evalUrluses. Fixing that is tracked in gh-1895.
The commit also makes other type of requests using the script tag version of the
script transport set its type to "GET", namely async scripts & ones with
scriptAttrsset in addition to the existing cross-domain ones.Fixes gh-3969
Checklist
If needed, a docs issue/PR was created at https://github.com/jquery/api.jquery.com