@netlify/plugin-csp-nonce 1.2.11 → 1.2.12

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.2.11",
+  "version": "1.2.12",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {

package/src/__csp-nonce.ts

@@ -19,27 +19,8 @@ type Params = {
 const params = inputs as Params;
 
 const handler = async (request: Request, context: Context) => {
-  const isGET = request.method === "GET";
-  // We only need to run this for HTTP GET requests.
-  // If it is not a GET, then return early.
-  //
-  // If we instead used `context.next(request)`
-  // we would be passing the request through this 
-  // edge function for no useful reason.
-  if (!isGET) {
-    return;
-  }
-
-
-  // At this point, we know it's a GET request,
-  // we have to now make the request, in order to
-  // see what the HTTP response's content-type is.
   const response = await context.next(request);
 
-  let header = params.reportOnly
-    ? "content-security-policy-report-only"
-    : "content-security-policy";
-
   // for debugging which routes use this edge function
   response.headers.set("x-debug-csp-nonce", "invoked");
 
@@ -55,6 +36,10 @@ const handler = async (request: Request, context: Context) => {
     return response;
   }
 
+  let header = params.reportOnly
+    ? "content-security-policy-report-only"
+    : "content-security-policy";
+
   // CSP_NONCE_DISTRIBUTION is a number from 0 to 1,
   // but 0 to 100 is also supported, along with a trailing %
   // @ts-ignore
@@ -197,6 +182,7 @@ export const config: Config = {
   .filter(Boolean),
   handler,
   onError: "bypass",
+  method: "GET",
 };
 
 export default handler;