Repository navigation
Missing script property nonce聽#111
Description
Hi Didomi team 馃憢
We're currently integrating the Didomi React SDK into a project that enforces a strict Content Security Policy (CSP), which requires all inline scripts to include a nonce attribute. However, we noticed that the SDK does not provide a way to set a nonce on the injected <script> tags, which causes CSP violations and blocks the Didomi scripts from executing.
Expected behavior:
There should be a way to pass a nonce value (e.g., via a prop or config option) so that the SDK can include it in the <script> tags it injects.
Actual behavior:
No nonce attribute is added to the injected scripts, and CSP blocks them.
Suggested solution:
Add support for a nonce prop in the React component or configuration object, which would be applied to all dynamically injected <script> elements.
Environment:
Package: @didomi/react
Framework: React
CSP: strict mode with script-src 'nonce-xyz'
Activity
felipe-saez commentedon Nov 7, 2025
Hi,
Thanks for bringing this up and for the detailed context. We鈥檙e currently looking into the issue and evaluating how to best support CSP nonces in our SDK.
We鈥檒l keep you posted as soon as we have any updates on this.
Kind regards,
Felipe
honzalo commentedon Nov 26, 2025
We鈥檝e added support for a custom nonce. You can now dynamically add the following code before the SDK is initialized:
The SDK will then automatically add the nonce attribute to the injected styles/script.
Let me know if you have any questions!