Skip to content

Commit

Permalink
code blocks and caps
Browse files Browse the repository at this point in the history
  • Loading branch information
bc-andreadao committed May 21, 2024
1 parent 94d184d commit 35f5e9f
Showing 1 changed file with 4 additions and 7 deletions.
11 changes: 4 additions & 7 deletions docs/api-docs/storefront/scripts-overview.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -139,16 +139,13 @@ You can add up to five SRI hashes and remove hashes when they are no longer vali

[Content Security Policy (CSP)]() is a standard that uses [`nonce` global attributes]() to allowlist non-static inline scripts.

Since inline scripts may contain dynamic handlebar template variables, BigCommerce uses `nonce` values instead of `intgrity` hashes to validate inline scripts. Browsers first check for `integrity` hashes before checking `nonce` values.
Since inline scripts may contain dynamic handlebar template variables, BigCommerce uses `nonce` values instead of `integrity` hashes to validate inline scripts. Browsers first check for `integrity` hashes before checking `nonce` values.

The `nonce` attribute in the `script` tag has a uniquely generated value.
On every page load, BigCommerce generates a nonce value and passes it to browsers through the HTTP `Content-Security-Policy` response header.
For any scripts that the merchant adds through Script Manager or the Scripts API, BigCommerce automatically injects the nonce value for them on every page load.


If you are editing custom scripts in the Stencil theme files (i.e. outside of script manager or the Scripts API), you need to add a nonce handlebar.
E.g. added script to checkout page.
On every page load, BigCommerce generates a `nonce` value and passes it to browsers through the HTTP `Content-Security-Policy` response header.
For any scripts that the merchant adds through Script Manager or the Scripts API, BigCommerce automatically injects the `nonce` value for them on every page load.

If you are editing custom scripts in the Stencil theme files (i.e. outside of Script Manager or the Scripts API), you need to add a `nonce` handlebar.

## Troubleshooting

Expand Down

0 comments on commit 35f5e9f

Please sign in to comment.