Script nonce policy

[kentcdodds]

Test Plan

1. Start the application locally (http://localhost:3000).
2. Open browser developer tools and navigate to the Console tab.
3. Reload the page.
4. Verify that there are no CSP warnings related to inline scripts or missing nonces. (Note: unsafe-eval warnings may still be present as they are report-only and not addressed by this change).

Checklist

• Tests updated
• Docs updated

Screenshots

Console reload shows no inline/nonce CSP warnings (report-only unsafe-eval remains).

---

 

---

Note

Low Risk
Small, localized SSR change that only threads an existing nonce value into the router; low likelihood of behavioral impact beyond CSP-related script tagging.

Overview
Ensures SSR output complies with the app’s Content Security Policy by passing the generated nonce to ServerRouter in entry.server.tsx, so any inline scripts emitted during server rendering can be tagged with the correct nonce.

^{Written by Cursor Bugbot for commit e9ba139. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}