fastify / fastify/fastify-swagger-ui
CSP directives seems to be empty
- Dominant language
- JavaScript
- Stars
- 191
- Forks
- 46
- Avg merge
- 12h 12m
- Merged PRs (30d)
- 2
Description
### Prerequisites
- [x] I have written a descriptive issue title
- [x] I have searched existing issues to ensure the bug has not already been reported
### Fastify version
5.4.0
### Plugin version
5.2.3
### Node.js version
22.19.0
### Operating system
macOS
### Operating system version (i.e. 20.04, 11.3, 10)
15.6.1 (24G90)
### Description
I'm using the following plugins in my fastify app:
- `@fastify/swagger`
- `@fastify/swagger-ui`
- `@fastify/helmet`
In the documentation of `@fastify/swagger` it is stated that it can be integrated nicely with `@fastify/helmet`.
Based on my investigation the csp.json should be populated like this:
- There is a dedicated script called `prepare-swagger-ui.js` that should calculate the hashes of all the inline script and style tags that are used in the html files of the ui
- The script stores the hashes in the `/static/csp.json` file
- This file is totally empty, which means that there is something wrong with this script or it is not running when the package is published
- This also means that if one would like to access the `fastifyIntance.swaggerCSP` directives those are empty as well
### Link to code that reproduces the bug
Minimal code to reproduce the error:
``` npm install fastify @fastify/helmet @fastify/swagger @fastify/swagger-ui ```
```typescript
import fastifyHelmet from "@fastify/helmet";
import fastifySwagger from "@fastify/swagger";
import fastifySwaggerUi from "@fastify/swagger-ui";
import fastify from "fastify";
const app = fastify();
await app.register(fastifySwagger, {
openapi: {
info: {
title: "Test API",
description: "Test API",
version: "1.0.0",
},
},
});
await app.register(fastifySwaggerUi, {
routePrefix: "/docs",
});
console.log(app.swaggerCSP);
```
Result running this script:
```json
{ script: [], style: [] }
```
### Expected Behavior
When setting up the plugin the csp directives should be populated with the correct hashes.
Contributor guide
Assessment
This issue has not been assessed yet.