Use nonce attribute for inline script if provided (vercel#3129)

dstaley · timneutkens · commit f1f83507dbf6 · 2017-10-19T21:30:34.000+02:00
diff --git a/server/document.js b/server/document.js
@@ -117,6 +117,10 @@ export class Main extends Component {
 }
 
 export class NextScript extends Component {
+  static propTypes = {
+    nonce: PropTypes.string
+  }
+
   static contextTypes = {
     _documentProps: PropTypes.any
   }
@@ -176,7 +180,7 @@ export class NextScript extends Component {
     __NEXT_DATA__.chunks = chunks
 
     return <div>
-      {staticMarkup ? null : <script dangerouslySetInnerHTML={{
+      {staticMarkup ? null : <script nonce={this.props.nonce} dangerouslySetInnerHTML={{
         __html: `
           __NEXT_DATA__ = ${htmlescape(__NEXT_DATA__)}
           module={}
