google / google/strict-csp

Incorrect Hash in webpack production build when filenames uses [contenthash]

Open
#48 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
49
Forks
11
PR merge metrics
No merged PRs in 30d

Description

Hello,

We are looking to use the webpack plugin to wrap our SPA in a hashed inline script, and have it working locally, but when the webpack builds in production, the hash that is being generated is incorrect. I have narrowed down the issue to using a webpack config with a filename containing [contenthash]. This fails in a fresh, ejected create-react-app as well when building in production mode.

## Reproduction Repo:
https://github.com/todda00/test-csp

## Steps to Reproduce:

Clone reproduction repo
Navigate to repo root directory

Run the following:
```
npm install
npm run build
npx serve -s build
```

When the `output.filename` webpack config is changed to something static, the script is hashed correctly. Support for [contenthash] is common and required in many CDN served static production sites such as ours.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.