fix(ssr): add nonces for strict-dynamic csp

wmertens · wmertens · commit a0298663bd12 · 2025-08-04T21:16:50.000+02:00
diff --git a/.changeset/young-groups-open.md b/.changeset/young-groups-open.md
@@ -0,0 +1,5 @@
+---
+'@builder.io/qwik': patch
+---
+
+fix: SSR was missing some places with nonce for CSP. Now CSP should work even when strict-dynamic
diff --git a/packages/qwik/src/server/preload-impl.ts b/packages/qwik/src/server/preload-impl.ts
@@ -66,12 +66,13 @@ export const preloaderPre = (
        * We add modulepreloads even when the script is at the top because they already fire during
        * html download
        */
-      jsx('link', { rel: 'modulepreload', href: preloaderPath }),
+      jsx('link', { rel: 'modulepreload', href: preloaderPath, nonce }),
       jsx('link', {
         rel: 'preload',
         href: bundleGraphPath,
         as: 'fetch',
         crossorigin: 'anonymous',
+        nonce,
       }),
       jsx('script', {
         type: 'module',
@@ -84,7 +85,7 @@ export const preloaderPre = (
 
   const corePath = simplifyPath(base, resolvedManifest?.manifest.core);
   if (corePath) {
-    beforeContent.push(jsx('link', { rel: 'modulepreload', href: corePath }));
+    beforeContent.push(jsx('link', { rel: 'modulepreload', href: corePath, nonce }));
   }
 };
 
diff --git a/packages/qwik/src/server/render.ts b/packages/qwik/src/server/render.ts
@@ -48,6 +48,7 @@ export async function renderToStream(
   const firstFlushTimer = createTimer();
   const buildBase = getBuildBase(opts);
   const resolvedManifest = resolveManifest(opts.manifest);
+  const nonce = opts.serverData?.nonce;
   function flush() {
     if (buffer) {
       nativeStream.write(buffer);
@@ -123,16 +124,21 @@ export async function renderToStream(
   let didAddQwikLoader = false;
   if (includeMode !== 'never' && qwikLoaderChunk) {
     beforeContent.unshift(
-      jsx('link', { rel: 'modulepreload', href: `${buildBase}${qwikLoaderChunk}` }),
+      jsx('link', {
+        rel: 'modulepreload',
+        href: `${buildBase}${qwikLoaderChunk}`,
+        nonce,
+      }),
       jsx('script', {
         type: 'module',
         async: true,
         src: `${buildBase}${qwikLoaderChunk}`,
+        nonce,
       })
     );
     didAddQwikLoader = true;
   }
-  preloaderPre(buildBase, resolvedManifest, opts.preloader, beforeContent, opts.serverData?.nonce);
+  preloaderPre(buildBase, resolvedManifest, opts.preloader, beforeContent, nonce);
 
   const renderTimer = createTimer();
   const renderSymbols: string[] = [];
@@ -161,7 +167,7 @@ export async function renderToStream(
         jsx('script', {
           type: 'qwik/json',
           dangerouslySetInnerHTML: escapeText(jsonData),
-          nonce: opts.serverData?.nonce,
+          nonce,
         })
       );
       if (snapshotResult.funcs.length > 0) {
@@ -170,7 +176,7 @@ export async function renderToStream(
           jsx('script', {
             'q:func': 'qwik/json',
             dangerouslySetInnerHTML: serializeFunctions(hash, snapshotResult.funcs),
-            nonce: opts.serverData?.nonce,
+            nonce,
           })
         );
       }
@@ -188,7 +194,7 @@ export async function renderToStream(
             async: true,
             type: 'module',
             dangerouslySetInnerHTML: qwikLoaderScript,
-            nonce: opts.serverData?.nonce,
+            nonce,
           })
         );
       }
@@ -200,7 +206,7 @@ export async function renderToStream(
         children.push(
           jsx('script', {
             dangerouslySetInnerHTML: content,
-            nonce: opts.serverData?.nonce,
+            nonce,
           })
         );
       }

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'@builder.io/qwik': patch
 +---
++
 +fix: SSR was missing some places with nonce for CSP. Now CSP should work even when strict-dynamic