apply_filters( ‘wp_inline_script_attributes’, array $attributes, string $data )

User Contributed Notes

1. Skip to note 2 content

   Anonymous User 2 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note

   This has to be used to make WP a CSP compliant system (at least, in the front end. Remains to be tested in the admin area)

   function wpdocs_add_nonce_to_scripts( $attr ) {
   	if ( 'text/javascript' !== $attr['type'] ) {
   		return $attr;
   	}
   
   	return array(
   		'type' => 'text/javascript',
   		'nonce' => '123',// Your Nonce. Obviously more featured than this example.
   	);
   }
   add_filter( 'wp_inline_script_attributes', 'wpdocs_add_nonce_to_scripts' );

   Then, you can use 'nonce-123' in your CSP Policy, example:
   "script-src 'self' 'noncoe-123';"

   • Note that this will override other attributes on the script tag. Would be better to set $attr[‘nonce’] on the existing array rather than return a new array.

     crstauf 2 years ago