---
title: "Important: The no-flash script runs under a Content Security Policy"
manual: "Frontend Theme for Extension Development"
version: "main"
source: "Changelog/2.0/Important-NoFlashScriptContentSecurityPolicy.rst"
rendered: "2026-09-28T12:50:34+00:00"
---

# Important: The no-flash script runs under a Content Security Policy {#important-no-flash-script-content-security-policy}

## Description {#description}

The theme's inline head script - `page.headerData.10`, which sets
`data-js` and applies a stored appearance, palette and outline before
first paint - was blocked by the browser on a site that enforces TYPO3's
frontend Content Security Policy
(`$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy']`):
the core's frontend policy allows scripts by a nonce only. The main navigation
then did not collapse, the display settings stayed hidden, and a stored dark
appearance was not applied before the first paint.

The extension now ships `Configuration/ContentSecurityPolicies.php`,
which extends `script-src` of the frontend scope with the sha256 hash of
the script. A hash and not a nonce: a nonce used on a page makes TYPO3 answer
that page `Cache-Control: private, no-store`, so no page could be cached
by browsers or proxies any more. TYPO3's own page cache is not affected.

## Impact {#impact}

A site that enforces the frontend policy and inherits the default frontend
scope needs to do nothing. Two cases need the site's own configuration:

-   A site that **overrides** `page.headerData.10` allows its own
    script, by the sha256 of that script. The hash is of the text between
    `<script>` and `</script>` exactly as it is rendered.
-   A site whose `csp.yaml` sets `inheritDefault: false` does not
    inherit the frontend scope, and adds the hash of the theme's script to its
    own `script-src`. The value is in
    `Configuration/ContentSecurityPolicies.php` of the extension, and it
    changes whenever the script changes.