ampproject / ampproject/amphtml
Allow nonce in <link> tag
- Dominant language
- JavaScript
- Stars
- 14.9k
- Forks
- 4.1k
- PR merge metrics
- No merged PRs in 30d
Description
### Description
Hi, my team is currently implementing CSP for our web. The implementation including adding nonce to style, link, script, and iframe. But i stumbled on an error when adding nonce to AMP pages. Currently got `The attribute 'nonce' may not appear in tag 'link'` from AMP Validator. While `` and `<script>` are allowed to use `nonce` already ([#6992](https://github.com/ampproject/amphtml/issues/6992#issuecomment-274555542)).
Implementation:
```
<link rel="dns-prefetch" href="https://www.google-analytics.com" nonce="...">
```
Expectation:
AMP page is considered valid when it contains `<link nonce="...">`
Contributor guide
Research direction
The issue names no files or tests; begin by locating the AMP Validator rules for attributes and the existing nonce handling referenced from #6992. Confirm the change by validating an AMP page containing and ensuring the validator accepts it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, web-dev
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100