Initial commit

app/assets/javascripts/turbolinks-csp.js

@@ -0,0 +1,12 @@
+// Include CSP nonce for every Turbolinks request (see: content_security_policy.rb)
+document.addEventListener("turbolinks:request-start", function(event) {
+  var xhr = event.data.xhr;
+  xhr.setRequestHeader("X-Turbolinks-Nonce", $("meta[name='csp-nonce']").prop('content'));
+});
+
+// Ensure all <script> tags on Turbolinks cached pages include a nonce
+document.addEventListener("turbolinks:before-cache", function() {
+  $('script[nonce]').each(function(index, element) {
+    $(element).attr('nonce', element.nonce);
+  })
+})