From cb01ecdf75d3ed70c0825a7a0e8c128b1e7f0652 Mon Sep 17 00:00:00 2001
From: Manuel Schiller <manuel.schiller@caligano.de>
Date: Mon, 29 Sep 2025 01:08:05 +0200
Subject: [PATCH] fix: nonce support

---
 packages/react-router/src/Asset.tsx             | 17 +++++++++++++----
 packages/react-router/src/HeadContent.tsx       |  4 +++-
 packages/react-router/src/Scripts.tsx           |  6 +++++-
 .../src/ssr/renderRouterToStream.tsx            |  2 ++
 .../src/ssr/renderRouterToStream.tsx            |  4 +++-
 .../src/ssr/renderRouterToString.tsx            |  4 +++-
 6 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/packages/react-router/src/Asset.tsx b/packages/react-router/src/Asset.tsx
index 266261d2e36..c16c65ad45e 100644
--- a/packages/react-router/src/Asset.tsx
+++ b/packages/react-router/src/Asset.tsx
@@ -12,7 +12,8 @@ export function Asset({
   tag,
   attrs,
   children,
-}: RouterManagedTag): React.ReactElement | null {
+  nonce,
+}: RouterManagedTag & { nonce?: string }): React.ReactElement | null {
   switch (tag) {
     case 'title':
       return (
@@ -23,16 +24,21 @@ export function Asset({
     case 'meta':
       return <meta {...attrs} suppressHydrationWarning />
     case 'link':
-      return <link {...attrs} suppressHydrationWarning />
+      return <link {...attrs} nonce={nonce} suppressHydrationWarning />
     case 'style':
       return (
         <style
           {...attrs}
           dangerouslySetInnerHTML={{ __html: children as string }}
+          nonce={nonce}
         />
       )
     case 'script':
-      return <Script attrs={attrs}>{children}</Script>
+      return (
+        <Script attrs={attrs} nonce={nonce}>
+          {children}
+        </Script>
+      )
     default:
       return null
   }
@@ -41,9 +47,11 @@ export function Asset({
 function Script({
   attrs,
   children,
+  nonce,
 }: {
   attrs?: ScriptAttrs
   children?: string
+  nonce?: string
 }) {
   const router = useRouter()
 
@@ -146,7 +154,7 @@ function Script({
   }
 
   if (attrs?.src && typeof attrs.src === 'string') {
-    return <script {...attrs} suppressHydrationWarning />
+    return <script {...attrs} suppressHydrationWarning nonce={nonce} />
   }
 
   if (typeof children === 'string') {
@@ -155,6 +163,7 @@ function Script({
         {...attrs}
         dangerouslySetInnerHTML={{ __html: children }}
         suppressHydrationWarning
+        nonce={nonce}
       />
     )
   }
diff --git a/packages/react-router/src/HeadContent.tsx b/packages/react-router/src/HeadContent.tsx
index 3115915ffbf..690e046bd7e 100644
--- a/packages/react-router/src/HeadContent.tsx
+++ b/packages/react-router/src/HeadContent.tsx
@@ -174,8 +174,10 @@ export const useTags = () => {
  */
 export function HeadContent() {
   const tags = useTags()
+  const router = useRouter()
+  const nonce = router.options.ssr?.nonce
   return tags.map((tag) => (
-    <Asset {...tag} key={`tsr-meta-${JSON.stringify(tag)}`} />
+    <Asset {...tag} key={`tsr-meta-${JSON.stringify(tag)}`} nonce={nonce} />
   ))
 }
 
diff --git a/packages/react-router/src/Scripts.tsx b/packages/react-router/src/Scripts.tsx
index bc2b84c6d0c..beb332cbd72 100644
--- a/packages/react-router/src/Scripts.tsx
+++ b/packages/react-router/src/Scripts.tsx
@@ -58,7 +58,11 @@ export const Scripts = () => {
   return (
     <>
       {allScripts.map((asset, i) => (
-        <Asset {...asset} key={`tsr-scripts-${asset.tag}-${i}`} />
+        <Asset
+          {...asset}
+          key={`tsr-scripts-${asset.tag}-${i}`}
+          nonce={router.options.ssr?.nonce}
+        />
       ))}
     </>
   )
diff --git a/packages/react-router/src/ssr/renderRouterToStream.tsx b/packages/react-router/src/ssr/renderRouterToStream.tsx
index 8c18a671a46..0c96c2f4c53 100644
--- a/packages/react-router/src/ssr/renderRouterToStream.tsx
+++ b/packages/react-router/src/ssr/renderRouterToStream.tsx
@@ -23,6 +23,7 @@ export const renderRouterToStream = async ({
   if (typeof ReactDOMServer.renderToReadableStream === 'function') {
     const stream = await ReactDOMServer.renderToReadableStream(children, {
       signal: request.signal,
+      nonce: router.options.ssr?.nonce,
     })
 
     if (isbot(request.headers.get('User-Agent'))) {
@@ -44,6 +45,7 @@ export const renderRouterToStream = async ({
 
     try {
       const pipeable = ReactDOMServer.renderToPipeableStream(children, {
+        nonce: router.options.ssr?.nonce,
         ...(isbot(request.headers.get('User-Agent'))
           ? {
               onAllReady() {
diff --git a/packages/solid-router/src/ssr/renderRouterToStream.tsx b/packages/solid-router/src/ssr/renderRouterToStream.tsx
index 87f70d99919..8abe29b3825 100644
--- a/packages/solid-router/src/ssr/renderRouterToStream.tsx
+++ b/packages/solid-router/src/ssr/renderRouterToStream.tsx
@@ -18,7 +18,9 @@ export const renderRouterToStream = async ({
 }) => {
   const { writable, readable } = new TransformStream()
 
-  const stream = Solid.renderToStream(children)
+  const stream = Solid.renderToStream(children, {
+    nonce: router.options.ssr?.nonce,
+  })
 
   if (isbot(request.headers.get('User-Agent'))) {
     await stream
diff --git a/packages/solid-router/src/ssr/renderRouterToString.tsx b/packages/solid-router/src/ssr/renderRouterToString.tsx
index dd3e584a965..8b65e1eb8e9 100644
--- a/packages/solid-router/src/ssr/renderRouterToString.tsx
+++ b/packages/solid-router/src/ssr/renderRouterToString.tsx
@@ -12,7 +12,9 @@ export const renderRouterToString = async ({
   children: () => JSXElement
 }) => {
   try {
-    let html = Solid.renderToString(children)
+    let html = Solid.renderToString(children, {
+      nonce: router.options.ssr?.nonce,
+    })
     router.serverSsr!.setRenderFinished()
     const injectedHtml = await Promise.all(router.serverSsr!.injectedHtml).then(
       (htmls) => htmls.join(''),