Write window.__CSP_NONCE__ to index.html

manisandro · manisandro · commit 83125511e9fe · 2025-12-15T22:25:55.000+01:00
diff --git a/src/qwc2_viewer.py b/src/qwc2_viewer.py
@@ -223,6 +223,7 @@ def qwc2_index(self, identity, params, request_url):
         viewer_index = viewer_index.replace('<head>', '<head>\n<meta http-equiv="Content-Security-Policy" content="%s">' % csp)
         viewer_index = viewer_index.replace('<script ', '<script nonce="%s" ' % nonce)
         viewer_index = viewer_index.replace('<script>', '<script nonce="%s">' % nonce)
+        viewer_index = viewer_index.replace('</head>', '<script nonce="%s">window.__CSP_NONCE__ = "%s";</script>\n</head>' % (nonce, nonce))
 
         return viewer_index
 
