n:nonce generates empty attribute

dakur

Hi,

maybe I'm missing something, but when I write <script n:nonce>...</script> in latte, I've got <script nonce>...</script> on output without any value. But according to generated template, it could not be possible:

echo $this->global->uiNonce ? " nonce=\"{$this->global->uiNonce}\"" : "";

I've already tried to debug it but without success. Any ideas? Thank you for any help.

Last edited by dakur (2020-06-03 15:07)

dakur

And I've forgotten to add that it did not work initially, then it started to work in a moment and now it does not work again. I have to have some problem in the app, but could not find the cause. That's why I am asking for ideas.

I've tried to remove cache already.

Last edited by dakur (2020-06-03 15:10)

dakur

Ok, so the response from server contains nonce correctly. But both Firefox and Chrome do not show its content in devtools, dunno why. Edge/EdgeHTML or IE display it. I've tried to disable all extensions, no change. No mention about it anywhere so maybe it is some brand new feature to hide nonce value in devtools or I have something else broken. Thanks for listening anyway. 🐘

Last edited by dakur (2020-06-03 15:46)

Marek Bartoš

Browsers hide it because it's a sensitive information (see). View your source code with view-source: protocol (view-source:example.com) to see not modified code which was sent by server

dakur

@Mabar Thanks for confirming. I still don't see why it is sensitive in devtools but good to know it's intended behaviour.

Marek Bartoš

Devtools show actual content of page. It would not make sense to show value which do not exist in DOM

Last edited by Mabar (2020-06-04 23:25)