new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

React Router · API · all subjects

security

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Content Security Policy nonce support in RSC

A Content Security Policy can use a per-response nonce to allow inline scripts required for RSC hydration. The nonce is configured in entry.ssr.tsx by passing it to `routeRSCServerRequest`, `RSCStaticRouter`, and the CSP response header. Generate a fresh nonce for each document response.

CSP nonce configuration in entry.ssr.tsx example

Example of CSP nonce configuration in entry.ssr.tsx: ```tsx export async function generateHTML( request: Request, serverResponse: Response, ): Promise<Response> { const nonce = crypto.randomUUID(); const response = await routeRSCServerRequest({ request, serverResponse, createFromReadableStream, nonce, async renderHTML(getPayload, options) { const payload = getPayload(); const bootstrapScriptContent = await import.meta.viteRsc.loadBootstrapScriptContent( "index", ); return renderHTMLToReadableStream( <RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />, { ...options, bootstrapScriptContent, formState: await payload.formState, signal: request.signal, }, ); }, }); response.headers.set( "Content-Security-Policy", `script-src 'self' 'nonce-${nonce}'`, ); return response; } ```

Give your agent this brain