fix: apply nonce to streaming redirect and SPA entry scripts (#2252)

Author: birkskyum

.changeset/lucky-moths-nonce.md

@@ -0,0 +1,8 @@
+---
+"@solidjs/start": patch
+---
+
+Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`:
+
+- The client-side redirect that streaming mode emits after the shell has already flushed (`<script>window.location=...</script>`) now carries the nonce.
+- The SPA entry script tag now carries the nonce, matching the SSR entry script.

packages/start/src/server/handler.ts

@@ -210,10 +210,20 @@ function handleStreamCompleteRedirect(context: PageEvent) {
   return ({ write }: { write: (html: string) => void }) => {
     context.complete = true;
     const to = context.response && context.response.headers.get("Location");
-    to && write(`<script>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`);
+    if (!to) return;
+    // The shell has already flushed, so the redirect has to happen client side.
+    // Carry the nonce so a strict `script-src` CSP doesn't block it.
+    const nonce = context.nonce ? ` nonce="${escapeAttribute(context.nonce)}"` : "";
+    write(
+      `<script${nonce}>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`,
+    );
   };
 }
 
+function escapeAttribute(value: string) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
+
 function stripBaseUrl(path: string) {
   const base = import.meta.env.SERVER_BASE_URL || import.meta.env.BASE_URL || "/";
   return stripPathBase(path, base);

packages/start/src/server/spa/StartServer.tsx

@@ -31,6 +31,7 @@ export function StartServer(props: { document: Component<DocumentComponentProps>
               <PatchVirtualDevStyles nonce={nonce} />
               <script
                 type="module"
+                nonce={nonce}
                 src={getSsrManifest("client").path(import.meta.env.START_CLIENT_ENTRY_URL)}
               />
             </>