Skip to content

Commit 82e1057

Browse files
authoredOct 14, 2023
Fix CSP test when using Turbopack (#56833)
Since Turbopack doesn't use eval-source-map the CSP nonce will pass correctly, nice improvement over the current state where you can't check CSP in dev.
1 parent c6fe20a commit 82e1057

File tree

1 file changed

+10
-8
lines changed

1 file changed

+10
-8
lines changed
 

‎test/e2e/app-dir/app/index.test.ts

+10-8
Original file line numberDiff line numberDiff line change
@@ -1827,7 +1827,10 @@ createNextDescribe(
18271827
expect($('body').find('script[async]').length).toBe(1)
18281828
})
18291829

1830-
if (!isDev) {
1830+
// Turbopack doesn't use eval by default, so we can check strict CSP.
1831+
if (!isDev || isTurbopack) {
1832+
// This test is here to ensure that we don't accidentally turn CSP off
1833+
// for the prod version.
18311834
it('should successfully bootstrap even when using CSP', async () => {
18321835
// This path has a nonce applied in middleware
18331836
const browser = await next.browser('/bootstrap/with-nonce')
@@ -1844,19 +1847,18 @@ createNextDescribe(
18441847
})
18451848
} else {
18461849
it('should fail to bootstrap when using CSP in Dev due to eval', async () => {
1847-
// This test is here to ensure that we don't accidentally turn CSP off
1848-
// for the prod version.
18491850
const browser = await next.browser('/bootstrap/with-nonce')
1850-
const response = await next.fetch('/bootstrap/with-nonce')
1851-
// We expect this page to response with CSP headers requiring a nonce for scripts
1852-
expect(response.headers.get('content-security-policy')).toContain(
1853-
"script-src 'nonce"
1854-
)
18551851
// We expect our app to fail to bootstrap due to invalid eval use in Dev.
18561852
// We assert the html is in it's SSR'd state.
18571853
expect(
18581854
await browser.eval('document.getElementById("val").textContent')
18591855
).toBe('initial')
1856+
1857+
const response = await next.fetch('/bootstrap/with-nonce')
1858+
// We expect this page to response with CSP headers requiring a nonce for scripts
1859+
expect(response.headers.get('content-security-policy')).toContain(
1860+
"script-src 'nonce"
1861+
)
18601862
})
18611863
}
18621864
})

0 commit comments

Comments
 (0)
Please sign in to comment.