Zengtudor/Nuxt
1
0
Fork 0
mirror of https://github.com/nuxt/nuxt.git synced 2024-11-23 14:15:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(csp): apply right csp header when status code is 304 (#8352)

Browse Source
This commit is contained in:
Zuckjet 2020-11-25 22:22:32 +08:00 committed by GitHub
parent 691f21c683
commit 135456f051
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
packages/server/src/middleware/nuxt.js
View File

@ -36,6 +36,14 @@ export default ({ options, nuxt, renderRoute, resources }) => async function nux
res.statusCode = context.nuxt.error.statusCode || 500 res.statusCode = context.nuxt.error.statusCode || 500
} }
if (options.render.csp && cspScriptSrcHashes) {
const { allowedSources, policies } = options.render.csp
const isReportOnly = !!options.render.csp.reportOnly
const cspHeader = isReportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'
res.setHeader(cspHeader, getCspString({ cspScriptSrcHashes, allowedSources, policies, isReportOnly }))
}
// Add ETag header // Add ETag header
if (!error && options.render.etag) { if (!error && options.render.etag) {
const { hash } = options.render.etag const { hash } = options.render.etag
@ -69,14 +77,6 @@ export default ({ options, nuxt, renderRoute, resources }) => async function nux
} }
} }
if (options.render.csp && cspScriptSrcHashes) {
const { allowedSources, policies } = options.render.csp
const isReportOnly = !!options.render.csp.reportOnly
const cspHeader = isReportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'
res.setHeader(cspHeader, getCspString({ cspScriptSrcHashes, allowedSources, policies, isReportOnly }))
}
// Send response // Send response
res.setHeader('Content-Type', 'text/html; charset=utf-8') res.setHeader('Content-Type', 'text/html; charset=utf-8')
res.setHeader('Accept-Ranges', 'none') // #3870 res.setHeader('Accept-Ranges', 'none') // #3870