Passing options to the nomodule fix script

[FalconsLanding]

Question
I'm updating a Content Security Policy for a client site and need to add a hash or nonce to the nomodule fix script.
I've tried the SCRIPT_TAG_ATTRS documented, but they only seem to affect script tags with a src.
Any help much appreciated !

Vite plugin version : 5.0.1
Craft : 5.7.1.1

[mike-moreau]

@khalwat experienced the same where <script type="module"> didn't have a nonce. Am I missing something?

Code looks like:

{{ craft.vite.script('src/js/app.js', false, {
        'nonce': nonce,
    }) }}

[khalwat]

@mike-moreau no, I would think that would do it as per https://nystudio107.com/docs/vite/#other-options

If you try other attributes, do they not show up on the script tags as well?

[mike-moreau]

@khalwat I'm seeing two script tags in the output, it is not on the first, but it is on the second.

We'd need it on both for Content Security Policy, yes? Or am I missing something.

Template code:

{% set nonce = 'my-nonce-sense' %}
    {{ craft.vite.script('themes/' ~ CURRENT_THEME ~ '/lib/index.js', false, {
        'nonce': nonce,
    }) }}

Output screenshot:

[khalwat]

Ooooooh @mike-moreau you're talking about the first <script> tag there where it is injecting the module preload shim yes?

That's just for older browsers, you can probably just disable that via the config setting:

https://github.com/nystudio107/craft-vite/blob/develop-v5/src/config.php#L77

[mike-moreau]

Thanks, likely we can turn it off.