ampproject / ampproject/amphtml

Allow nonce in <link> tag

Open
#36,115 2 comments 0 reactions 0 assignees View on GitHub
Stale Type: Feature Request
Dominant language
JavaScript
Stars
14.9k
Forks
4.1k
PR merge metrics
No merged PRs in 30d

Description

### Description

Hi, my team is currently implementing CSP for our web. The implementation including adding nonce to style, link, script, and iframe. But i stumbled on an error when adding nonce to AMP pages. Currently got `The attribute 'nonce' may not appear in tag 'link'` from AMP Validator. While `` and `<script>` are allowed to use `nonce` already ([#6992](https://github.com/ampproject/amphtml/issues/6992#issuecomment-274555542)).

Implementation:
```
<link rel="dns-prefetch" href="https://www.google-analytics.com" nonce="...">
```

Expectation:
AMP page is considered valid when it contains `<link nonce="...">`

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests; begin by locating the AMP Validator rules for attributes and the existing nonce handling referenced from #6992. Confirm the change by validating an AMP page containing and ensuring the validator accepts it.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, web-dev
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.