[6.x] Allow static cache JS to be externalized - #15342
Merged
Merged
Conversation
ryanmitchell
changed the title
jasonvarga
force-pushed
the
feature/nocache-csp
branch
from
September 18, 2026 19:34
e91f437 to
fc5bbd2
Compare
The views were publishable, so a site could freeze a copy of the CSRF and nocache JS and silently miss future fixes to it. The publish tag copies the whole directory, so someone who only wanted to change the script tag would have frozen both JS bodies too. The tag itself also shouldn't have been a view: it re-branched on inline vs external, a decision the config already makes, so a published copy could contradict the config and break the mode it wasn't trying to touch. The nonce example that justified publishing doesn't hold either. These tags are injected into full measure responses only, and those get written to disk and replayed, so a per-request nonce would be frozen and reused for every visitor. External delivery is the answer for a strict policy, which is what this PR is for. So FileCacher builds the tags itself and owns inline vs external in one place, and both replacers just ask it for one. The default JS stays in the heredocs it was already in, leaving FileCacher purely additive. StaticCache::csrfTokenJs() and nocacheJs() still replace the bodies outright. Also reverts the FakesViews namespace hint fix, which was only needed because the replacers rendered a statamic:: view. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jasonvarga
force-pushed
the
feature/nocache-csp
branch
from
September 18, 2026 20:15
fc5bbd2 to
ebae1f2
Compare
Member
|
I've pushed a change that drops the publishable views and the The nonce wouldn't actually have worked. These tags only get injected into full-measure responses, so the nonce would be baked into the HTML file and handed to every visitor, and a constant nonce isn't worth much. Which just means the Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #8802.
Background
Full-measure (file) static caching injects two small inline
<script>blocks into every cached page — one to swap the placeholder CSRF token, one to hydratenocacheregions. A site sendingContent-Security-Policy: script-src 'self'blocks inline scripts, so full static caching can't be used with that policy.What this does
Adds a
script_deliveryoption toconfig/static_caching.php:inline(default) — unchanged behaviour, byte-identical output.external— the snippets are served from same-origin routes and referenced with<script src="…">, which satisfiesscript-src 'self'with no nonce or hash.The two routes (
statamic.nocache.js,statamic.csrf.js, under the action-route prefix) are only registered whenscript_deliveryisexternal. They respond withapplication/javascriptand an ETag.The existing
StaticCache::nocacheJs()/csrfTokenJs()overrides still work, and the default snippets are unchanged.Backwards compatibility
Default is
inline; existing sites see identical output. No breaking changes.