Automatically add CSP Nonce to script tags

[anywaifu]

Description

{% htmx-script %} doesn't allow to receive CSP_NONCE. My workaround was using like <script src="{% static 'django_htmx/htmx.min.js' %}" nonce="{{ CSP_NONCE }}" defer></script> but then I don't have the optimization when debugging :/

[anywaifu]

Not sure why, maybe because it is in , even passing the nonce was not working.. Just managed to solve it by adding <meta name="htmx-config" content='{"inlineStyleNonce": "{{ CSP_NONCE }}"}'>

[adamchainz]

Why do you need the nonce when you an allow "self"?

[adamchainz]

One thing we could do, anyway, is detect the nonce in the context and add it automatically.

Django 6 has built in CSP support so we'd want to support that nonce too.

I guess it can't hurt.

The bug fix you described is I think for a second tier htmx issue with style tags in your responses.

[anywaifu]

Hey! I am really new to CSP and I set everything as NONCE, only using SELF / s3URL for images and fonts.. for most of styles adding nonce="{{ CSP_NONCE }}"} was enough, but by some reason, with HTMX it didn't work.. then adding it to inlineStyleNonce worked. I think the issue was due to the loading style of hidding / showing as you mentioned