fastify / fastify/fastify-swagger-ui

CSP directives seems to be empty

Open
#233 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
191
Forks
46
Avg merge
12h 12m
Merged PRs (30d)
2

Description

### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have searched existing issues to ensure the bug has not already been reported

### Fastify version

5.4.0

### Plugin version

5.2.3

### Node.js version

22.19.0

### Operating system

macOS

### Operating system version (i.e. 20.04, 11.3, 10)

15.6.1 (24G90)

### Description

I'm using the following plugins in my fastify app:
- `@fastify/swagger`
- `@fastify/swagger-ui`
- `@fastify/helmet`

In the documentation of `@fastify/swagger` it is stated that it can be integrated nicely with `@fastify/helmet`.

Based on my investigation the csp.json should be populated like this:
- There is a dedicated script called `prepare-swagger-ui.js` that should calculate the hashes of all the inline script and style tags that are used in the html files of the ui
- The script stores the hashes in the `/static/csp.json` file
- This file is totally empty, which means that there is something wrong with this script or it is not running when the package is published
- This also means that if one would like to access the `fastifyIntance.swaggerCSP` directives those are empty as well

### Link to code that reproduces the bug

Minimal code to reproduce the error:
``` npm install fastify @fastify/helmet @fastify/swagger @fastify/swagger-ui ```

```typescript
import fastifyHelmet from "@fastify/helmet";
import fastifySwagger from "@fastify/swagger";
import fastifySwaggerUi from "@fastify/swagger-ui";
import fastify from "fastify";

const app = fastify();

await app.register(fastifySwagger, {
openapi: {
info: {
title: "Test API",
description: "Test API",
version: "1.0.0",
},
},
});

await app.register(fastifySwaggerUi, {
routePrefix: "/docs",
});

console.log(app.swaggerCSP);
```

Result running this script:

```json
{ script: [], style: [] }
```

### Expected Behavior

When setting up the plugin the csp directives should be populated with the correct hashes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.