13 lines
523 B
JavaScript
13 lines
523 B
JavaScript
|
// Include CSP nonce for every Turbolinks request (see: content_security_policy.rb)
|
||
|
|
document.addEventListener("turbolinks:request-start", function(event) {
|
||
|
|
var xhr = event.data.xhr;
|
||
|
|
xhr.setRequestHeader("X-Turbolinks-Nonce", $("meta[name='csp-nonce']").prop('content'));
|
||
|
|
});
|
||
|
|
|
||
|
|
// Ensure all <script> tags on Turbolinks cached pages include a nonce
|
||
|
|
document.addEventListener("turbolinks:before-cache", function() {
|
||
|
|
$('script[nonce]').each(function(index, element) {
|
||
|
|
$(element).attr('nonce', element.nonce);
|
||
|
|
})
|
||
|
|
})
|