@adonis-agora/durable-dashboard 0.2.3 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# @adonis-agora/durable-dashboard
|
|
2
2
|
|
|
3
|
+
## 0.2.4
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#84](https://github.com/DavideCarvalho/adonis-agora-durable/pull/84) [`5f8c6bd`](https://github.com/DavideCarvalho/adonis-agora-durable/commit/5f8c6bd7dbd9e9afd723ce5dd0a0f29a706059b2) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: every API request 404 under a nonce CSP — fixed.
|
|
8
|
+
|
|
9
|
+
The provider used to hand the SPA its mount/API base as an inline `<script>` setting
|
|
10
|
+
`window.__DURABLE_BASE__`/`__DURABLE_API__`. A host with `script-src 'self' 'nonce-…'`
|
|
11
|
+
(`@adonisjs/shield`'s `@nonce`, the recommended setup) drops that script silently; the SPA then fell
|
|
12
|
+
back to `/durable/api`, and on any other mount path every request from a console that rendered
|
|
13
|
+
perfectly well answered 404. The config now travels as a `<script type="application/json">` data
|
|
14
|
+
block, which is never executed and so cannot be refused. Nothing to change on the host; the globals
|
|
15
|
+
are still honoured as a fallback for tests and hand-embedding.
|
|
16
|
+
|
|
3
17
|
## 0.2.3
|
|
4
18
|
|
|
5
19
|
### Patch Changes
|