fix(nonce): make sure nonce nitro plugin is executed last

Baroshem · Jul 18, 2023 · 0c24f69 · 0c24f69
1 parent b25342d
commit 0c24f69
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 10 deletions.
diff --git a/src/module.ts b/src/module.ts
@@ -230,32 +230,32 @@ const registerSecurityNitroPlugins = (
       config.plugins.push(
         normalize(
           fileURLToPath(
-            new URL("./runtime/nitro/plugins/hidePoweredBy", import.meta.url)
+            new URL("./runtime/nitro/plugins/01-hidePoweredBy", import.meta.url)
           )
         )
       );
     }
 
-    // Nitro plugin to enable nonce for CSP
-    if (nuxt.options.security.nonce) {
+    // Register nitro plugin to enable CSP for SSG
+    if (
+      typeof securityOptions.headers === "object" &&
+      securityOptions.headers.contentSecurityPolicy
+    ) {
       config.plugins.push(
         normalize(
           fileURLToPath(
-            new URL("./runtime/nitro/plugins/cspNonce", import.meta.url)
+            new URL("./runtime/nitro/plugins/02-cspSsg", import.meta.url)
           )
         )
       );
     }
 
-    // Register nitro plugin to enable CSP for SSG
-    if (
-      typeof securityOptions.headers === "object" &&
-      securityOptions.headers.contentSecurityPolicy
-    ) {
+    // Nitro plugin to enable nonce for CSP
+    if (nuxt.options.security.nonce) {
       config.plugins.push(
         normalize(
           fileURLToPath(
-            new URL("./runtime/nitro/plugins/cspSsg", import.meta.url)
+            new URL("./runtime/nitro/plugins/99-cspNonce", import.meta.url)
           )
         )
       );

diff --git a/src/runtime/nitro/plugins/hidePoweredBy.ts → ...runtime/nitro/plugins/01-hidePoweredBy.ts b/src/runtime/nitro/plugins/hidePoweredBy.ts → ...runtime/nitro/plugins/01-hidePoweredBy.ts
diff --git a/src/runtime/nitro/plugins/cspSsg.ts → src/runtime/nitro/plugins/02-cspSsg.ts b/src/runtime/nitro/plugins/cspSsg.ts → src/runtime/nitro/plugins/02-cspSsg.ts
diff --git a/src/runtime/nitro/plugins/cspNonce.ts → src/runtime/nitro/plugins/99-cspNonce.ts b/src/runtime/nitro/plugins/cspNonce.ts → src/runtime/nitro/plugins/99-cspNonce.ts