No way to set nonce on inline script for Content Security Policy

[fierysolid]

The ApolloNextAppProvider creates an inline script during SSR that is meant to set the ApolloSSRDataTransport property on the window, but with a strict CSP and 'unsafe-inline' disabled, there is no way to attach the script-src nonce to this inline script.

The nonce is set in the x-nonce request header and NextJS uses this to set the nonce on all of the inline scripts it creates. Can we also grab this header and attach it to the inline script being created by apollo?

[fierysolid]

JK I found the extraScriptProps

[github-actions]

Do you have any feedback for the maintainers? Please tell us by taking a one-minute survey. Your responses will help us understand Apollo Client usage and allow us to serve you better.

[phryneas]

Glad you found it!