Changeset e685f55 in Klonkt for src/views/pages/paid-passkey.ejs

Timestamp:

07/21/2026 01:54:46 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

603d246

Parents:

d48ea02

git-author:

Robin <roboburr@…> (07/21/2026 01:54:23 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 01:54:46 AM)

Message:

Fix: paid client scripts were blocked by CSP (garbage nonce)

The paid-* views wrote nonce="<%= cspNonce %>" on their <script> tags, but
cspNonce is not a real value in the template: renderPage's default is a
function, so it rendered as nonce="() =&gt; ". injectCspNonce only adds
the real nonce to <script> tags that have NO nonce attribute yet, so these
tags kept the garbage nonce. Under our strict-dynamic CSP (no unsafe-inline,
no host sources, 'self' ignored) that blocked every one of them:

• the vendored SimpleWebAuthnBrowser lib never loaded
• the passkey-creation script (slice 3) never ran
• the per-post unlock script (slice 4) never ran
• the paid-price toggle in the editor (slice 2) never ran

Tests never caught it: the WebAuthn ceremony only runs in a real browser,
so nothing exercised these inline scripts. The convention everywhere else
is a plain <script> with no nonce; injectCspNonce fills in the real one.
Drop the hand-written nonce attribute so that happens.

Changed files:
src/views/pages/paid-gate.ejs

• drop nonce attr on the vendored lib + unlock scripts

src/views/pages/paid-passkey.ejs

• drop nonce attr on the vendored lib + registration scripts

src/views/pages/post-edit.ejs

• drop nonce attr on the paid-price toggle script

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/views/pages/paid-passkey.ejs (modified) (1 diff)

src/views/pages/paid-passkey.ejs

@@ -12 +12 @@
 </section>
 
-<script src="/assets/vendor/simplewebauthn-browser.umd.min.js" nonce="<%= cspNonce %>"></script>
-<script nonce="<%= cspNonce %>">
+<script src="/assets/vendor/simplewebauthn-browser.umd.min.js"></script>
+<script>
 (function () {
   var options = <%- optionsJson %>;