fix: apply CSP nonce to Pages Router streamed Suspense scripts - #97851
Open
mataspetrikas wants to merge 1 commit into
Open
fix: apply CSP nonce to Pages Router streamed Suspense scripts#97851mataspetrikas wants to merge 1 commit into
mataspetrikas wants to merge 1 commit into
Conversation
The Pages Router already derives a nonce from the request's Content-Security-Policy header and applies it to the script tags it renders, but it never forwards that nonce to Fizz. React therefore emits its Suspense reveal instructions (the $RB/$RC/$RS family) as bare <script> tags, which a nonce-based CSP blocks. renderToInitialFizzStream already accepts streamOptions and passes them straight through to renderToReadableStream, and React honours a nonce there, so the shell render just needs to pass the nonce it already has. Fixes vercel#96443
mataspetrikas
marked this pull request as ready for review
August 25, 2026 08:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi NextJs team,
What?
I am working on a large pages-router-based NextJS app and while implementing CSP headers, I have discovered an annoying bug. It seems that nonce is not passed to the suspense boundaries when using Pages Router. The App router seems to be unaffected. The bug was already previously reported in teh past eg #96443
Why?
We could see that the Pages router correctly gets the nonce from the header and applies it to the script tags it renders. But it doesn't hand it over to React Fizz renderer. So the scripts in boundaries get blocked when enfiorcing the CSP policy. An example of a blocked script would be the Reacts reveal timing script
requestAnimationFrame(function(){$RT=performance.now()});that gets inlined by React 19.x.How?
We tried different approaches to fix that but we either had to rewrite the script tags in the server or monkey-patch nextJS. Using Claude we could narrow down the problem to one line in the
render.tsx- simply by passing the nonce to the Fizz it would fix the issue.Tests added that should show how the suspend then works after CSP fix - it fails without a fix, correctly verifying the problem.
Pls let me know if you need any chanegs or additional info.
Fixes #96443