From 14a6a2f962dbd1063be204cb6332b3e6564f1ffb Mon Sep 17 00:00:00 2001 From: Rich Harris Date: Fri, 12 Dec 2025 11:13:44 -0500 Subject: [PATCH] example of using hashes in CSP header --- documentation/docs/06-runtime/05-hydratable.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/documentation/docs/06-runtime/05-hydratable.md b/documentation/docs/06-runtime/05-hydratable.md index 3d3597e7bc..9a64ff0ea4 100644 --- a/documentation/docs/06-runtime/05-hydratable.md +++ b/documentation/docs/06-runtime/05-hydratable.md @@ -97,4 +97,13 @@ const { head, body, hashes } = await render(App, { }); ``` -`hashes.script` will be an array of strings like `["sha256-abcd123"]`. We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future. +`hashes.script` will be an array of strings like `["sha256-abcd123"]`. As with `nonce`, the hashes should be used in your CSP header: + +```js +response.headers.set( + 'Content-Security-Policy', + `script-src ${hashes.script.map((hash) => `'${hash}'`).join(' ')}` + ); +``` + +We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future.