From 100fb61ad11bd5f79ab4ab79c6e40fa706ee85bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Wed, 30 Sep 2026 14:13:18 -0300
Subject: [PATCH 01/13] feat: resolve the CSP nonce per request with
 start.nonce

Generated entries rendered with a fixed { manifest }, so the hydration
bootstrap, the streamed data and swap scripts and the modulepreload links
never carried a nonce, and nothing inside the app could supply one.

start.nonce names a module resolved after the middleware chain; the
handler passes its result (or handleRequest's nonce, which wins) to the
generated renderToStream, the client-entry tag, the post-flush redirect
fallback and, in dev, the injected head tags. Authored entries receive it
as context.nonce. The { script, style } form no longer throws in the
client-entry transform, and invalid values are rejected.
---
 .changeset/start-csp-nonce.md        |   7 +
 README.md                            |  52 ++++-
 examples/start-ssr/src/middleware.ts |   4 +
 examples/start-ssr/src/nonce.ts      |  13 ++
 examples/start-ssr/test/run.mjs      | 284 ++++++++++++++++++++++++++-
 examples/start-ssr/vite.config.ts    |  12 ++
 src/ssr/index.ts                     | 167 ++++++++++++++--
 virtual-solid-manifest.d.ts          |  11 ++
 8 files changed, 531 insertions(+), 19 deletions(-)
 create mode 100644 .changeset/start-csp-nonce.md
 create mode 100644 examples/start-ssr/src/nonce.ts

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
new file mode 100644
index 00000000..3e2a6706
--- /dev/null
+++ b/.changeset/start-csp-nonce.md
@@ -0,0 +1,7 @@
+---
+'@solidjs/vite-plugin': minor
+---
+
+`start.nonce`: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>` that resolves the request's CSP nonce inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The handler passes the resolved nonce to the generated entry's `renderToStream` — the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links now carry it — as well as to the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Until now generated entries rendered without a nonce, so a strict `script-src 'nonce-…'` policy required hand-written `entry-server` / `entry-client` files (and gave up the generated error boundary). `handleRequest(request, { nonce })` keeps working as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
+
+Also fixes the object form of the nonce: `handleRequest(request, { nonce: { script, style } })` threw `TypeError: value.replace is not a function` while building the client-entry tag. The tag and the redirect fallback now take the script destination through `@solidjs/web`'s `scriptNonce`, and an invalid nonce from either source (including an array or an object with keys other than `script` / `style`) is rejected with an error naming it.
diff --git a/README.md b/README.md
index 0a8ff20d..cc01a82d 100644
--- a/README.md
+++ b/README.md
@@ -230,7 +230,7 @@ same server functions.
 The object form carries the options (`start: true` is pure sugar for
 `start: {}` — both mean the identical start mode with defaults, and
 `false`/absent means off): `app`, `document`, `entryServer`, `entryClient`,
-`middleware`, `setup`, `renderMode`, `env`, `devtools`, `errorBoundary`,
+`middleware`, `setup`, `renderMode`, `nonce`, `env`, `devtools`, `errorBoundary`,
 `css`, `external`, `node`, all documented below.
 
 Install `@solidjs/start-devtools` as a development dependency to add the
@@ -583,6 +583,56 @@ response head when the awaited render completes (`@solidjs/web` 2.0.0-rc.7+),
 just as streaming freezes it at shell flush. Server mode only — in client mode the served shell has no boundaries to
 settle, so the option is a documented no-op there.
 
+**`nonce`** — the per-request CSP nonce, for a `Content-Security-Policy`
+with `script-src 'nonce-…'` and no `'unsafe-inline'`. A module path
+(relative to the Vite root, following the `middleware`/`setup`/`renderMode`
+convention) default-exporting `(event) => CSPNonce | undefined |
+Promise<...>`, where `CSPNonce` is `@solidjs/web`'s `string | { script,
+style }` (each a string, or `false` to leave that destination un-nonced). It runs inside the request scope after the middleware chain, so
+the middleware that generates the nonce and sets the header can hand it over
+through `event.locals`:
+
+```ts
+// vite.config.ts
+solid({
+  start: { middleware: './src/middleware.ts', nonce: './src/nonce.ts' },
+  ssr: true,
+});
+
+// src/middleware.ts
+import { getRequestEvent } from '@solidjs/web';
+
+export default async function csp(request: Request, next: (request?: Request) => Promise<Response>) {
+  const nonce = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
+  getRequestEvent()!.locals.nonce = nonce;
+  const response = await next();
+  response.headers.set('Content-Security-Policy', `script-src 'nonce-${nonce}' 'strict-dynamic'`);
+  return response;
+}
+
+// src/nonce.ts
+import type { RequestEvent } from '@solidjs/web';
+
+export default function nonce(event: RequestEvent) {
+  return event.locals.nonce as string | undefined;
+}
+```
+
+The handler passes the resolved nonce to the generated entry's
+`renderToStream`, so the hydration bootstrap, the streamed data and swap
+scripts and the `modulepreload` links all carry it, and to the injected
+client-entry tag and the post-flush redirect fallback — in dev as well, where
+the head tags the handler injects carry it too: the style patch and Vite
+client scripts (with `'strict-dynamic'`, the modules they load are trusted in
+turn), the collected styles, and a `csp-nonce` meta the Vite client reads for
+the styles it injects. Inline scripts your
+own `Document` renders still need it spelled out
+(`nonce={getRequestEvent()?.locals.nonce}`). Authored entries receive the
+value as `context.nonce` in `render()`. Hosts driving the handler directly
+can pass `handleRequest(request, { nonce })`, which wins over the module.
+Server mode only — the client-mode shell is prerendered once at build time,
+so there is no request to take a nonce from.
+
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
 elsewhere with `start: { env: './path' }`, disable with `env: false` —
diff --git a/examples/start-ssr/src/middleware.ts b/examples/start-ssr/src/middleware.ts
index 4ae1dd74..aa429b99 100644
--- a/examples/start-ssr/src/middleware.ts
+++ b/examples/start-ssr/src/middleware.ts
@@ -120,6 +120,10 @@ async function first(request: Request, next: Next): Promise<Response> {
   const event = getRequestEvent()!;
   event.locals.order = ['first'];
   event.locals.user = 'mw-user';
+  // `start.nonce` evidence (nonce mode): the nonce module reads what the
+  // chain stored, proving it runs after the middleware.
+  const cspNonce = request.headers.get('x-csp-nonce');
+  if (cspNonce) event.locals.nonce = cspNonce;
   if (new URL(request.url).pathname === '/blocked') {
     // Early return: this Response never goes through createSSRResponse, so
     // the stub write below only reaches the wire through the handler
diff --git a/examples/start-ssr/src/nonce.ts b/examples/start-ssr/src/nonce.ts
new file mode 100644
index 00000000..170887d4
--- /dev/null
+++ b/examples/start-ssr/src/nonce.ts
@@ -0,0 +1,13 @@
+// Per-request CSP nonce for the nonce e2e mode (SSR_NONCE=module wires it
+// through `start.nonce` in vite.config.ts, next to SSR_MIDDLEWARE=1).
+// Server-only: only the generated handler imports it. The recipe from the
+// README: the middleware generates the nonce (here it takes the test's
+// `x-csp-nonce` header instead, to stay deterministic) and stores it on
+// `event.locals`; this module hands it to the handler, which runs it after
+// the chain.
+import type { RequestEvent } from '@solidjs/web';
+
+export default function nonce(event: RequestEvent): string | undefined {
+  const value = event.locals.nonce;
+  return typeof value === 'string' ? value : undefined;
+}
diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index a06cf87d..4f58e1c7 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -141,7 +141,7 @@
 //
 // Requires the plugin built (pnpm build at the repo root) and Google Chrome.
 // Usage: node test/run.mjs
-// [dev|prod|document|css-filter|entries|endpoint|configure|no-middleware|middleware|preview|render-mode|base|builder-order|builder-prepare|extra-input|babel-hmr|frames|external|observe|perf-tracks|detect|vitest|node]
+// [dev|prod|document|css-filter|entries|endpoint|configure|no-middleware|middleware|preview|render-mode|nonce|base|builder-order|builder-prepare|extra-input|babel-hmr|frames|external|observe|perf-tracks|detect|vitest|node]
 // (default: all)
 
 import { spawn, execSync, execFileSync } from 'node:child_process';
@@ -5892,6 +5892,286 @@ async function runVitestMode() {
   );
 }
 
+// `start.nonce` (SSR_NONCE in vite.config.ts): the per-request CSP nonce.
+// Asserted on direct handler dispatch in dev and against the built handler:
+// - `handleRequest(request, { nonce })` reaches the render, not just the
+//   client-entry tag: every <script> (hydration bootstrap, streamed data and
+//   swap scripts, the client entry, the dev head) and every modulepreload
+//   link carries it, escaped, and so does the post-flush redirect fallback;
+//   the `{ script, style }` form works (it used to throw building the entry
+//   tag) and an invalid value — a primitive, an array, a typo'd key — is
+//   rejected,
+// - dev head: the collected styles carry the style nonce and a `csp-nonce`
+//   meta hands it to the Vite client,
+// - `start.setup` renders with the nonce too (its own render path),
+// - the module form (src/nonce.ts) resolves the nonce after the middleware
+//   chain — it reads what src/middleware.ts stored on `event.locals` — and
+//   the runtime option still wins over it,
+// - the built handler does the same through both `handleRequest` and the
+//   default Fetchable (the path hosts like Nitro dispatch through, which
+//   passes no options),
+// - codegen: the nonce module is imported only when configured, and a
+//   missing module path is rejected at config time.
+async function runNonceMode() {
+  const mode = 'nonce';
+  console.log(`\n=== ${mode.toUpperCase()} ===`);
+
+  const withNodeEnvRestored = async (fn) => {
+    const before = process.env.NODE_ENV;
+    try {
+      return await fn();
+    } finally {
+      if (before === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = before;
+    }
+  };
+  const build = (env) =>
+    execSync('pnpm run build', {
+      cwd: exampleDir,
+      stdio: 'pipe',
+      env: { ...process.env, NODE_ENV: 'production', ...env },
+    });
+  const page = (headers) =>
+    new Request('http://localhost/', { headers: { accept: 'text/html', ...(headers || {}) } });
+  // Every script and modulepreload tag in the document, opening tags only.
+  const nonceTargets = (html) => [
+    ...(html.match(/<script\b[^>]*>/g) || []),
+    ...(html.match(/<link\b[^>]*>/g) || []).filter((tag) => tag.includes('modulepreload')),
+  ];
+  const everyTagCarries = (html, value) => {
+    const tags = nonceTargets(html);
+    const attr = ` nonce="${value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;')}"`;
+    const missing = tags.filter((tag) => !tag.includes(attr));
+    return {
+      ok: tags.length >= 3 && missing.length === 0,
+      detail: `${tags.length} tags, missing: ${missing.join(' ').slice(0, 200)}`,
+    };
+  };
+  const carriesNone = (html) => !/\snonce="/.test(html);
+
+  // ---- Config validation --------------------------------------------------
+  process.env.SSR_NONCE = './src/no-such-nonce.ts';
+  let configError = '';
+  try {
+    await withNodeEnvRestored(() => resolveConfig({ root: exampleDir }, 'serve'));
+  } catch (e) {
+    configError = String(e && e.message ? e.message : e);
+  } finally {
+    delete process.env.SSR_NONCE;
+  }
+  record(
+    mode,
+    'config',
+    'missing module path rejected at config time',
+    configError.includes('start.nonce') && configError.includes('no-such-nonce'),
+    configError.slice(0, 300) || 'config resolved without error',
+  );
+
+  // ---- Direct dispatch: the runtime option, no module configured ----------
+  let probe;
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const stringForm = await (await handler.handleRequest(page(), { nonce: 'dev"<&' })).text();
+    const stringCheck = everyTagCarries(stringForm, 'dev"<&');
+    record(
+      mode,
+      'override',
+      'handleRequest({ nonce }) reaches every script and modulepreload, escaped',
+      stringCheck.ok,
+      stringCheck.detail,
+    );
+    const objectResponse = await handler.handleRequest(page(), {
+      nonce: { script: 'script-only', style: false },
+    });
+    const objectForm = await objectResponse.text();
+    const objectCheck = everyTagCarries(objectForm, 'script-only');
+    record(
+      mode,
+      'override',
+      'the { script, style } form renders with the script nonce',
+      objectResponse.status === 200 && objectCheck.ok,
+      `status ${objectResponse.status}, ${objectCheck.detail}`,
+    );
+    record(
+      mode,
+      'override',
+      'without a nonce the document carries none',
+      carriesNone(await (await handler.handleRequest(page())).text()),
+    );
+    const redirect = await (
+      await handler.handleRequest(
+        new Request('http://localhost/redirect-post', { headers: { accept: 'text/html' } }),
+        { nonce: 'redirect-nonce' },
+      )
+    ).text();
+    record(
+      mode,
+      'override',
+      'post-flush redirect fallback carries the nonce',
+      /<script nonce="redirect-nonce">[^<]*window\.location/.test(redirect),
+    );
+    const devStyle = '<style data-asset="probe.css">.probe{}</style>';
+    const styled = await (
+      await handler.handleRequest(page(), { nonce: 'style-nonce', devHead: devStyle })
+    ).text();
+    record(
+      mode,
+      'override',
+      'dev styles carry the style nonce and a csp-nonce meta is emitted',
+      styled.includes('<style nonce="style-nonce" data-asset="probe.css">') &&
+        styled.includes('<meta property="csp-nonce" nonce="style-nonce">'),
+    );
+    const scriptOnly = await (
+      await handler.handleRequest(page(), {
+        nonce: { script: 'script-only', style: false },
+        devHead: devStyle,
+      })
+    ).text();
+    record(
+      mode,
+      'override',
+      'style: false leaves the dev styles and the meta un-nonced',
+      scriptOnly.includes('<style data-asset="probe.css">') && !scriptOnly.includes('csp-nonce'),
+    );
+    for (const [value, label, expected] of [
+      [42, 'a number', 'number'],
+      [['a'], 'an array', 'an array'],
+      [{ nonce: 'a' }, 'an object with a misspelled key', '["nonce"]'],
+    ]) {
+      let rejection = '';
+      try {
+        await handler.handleRequest(page(), { nonce: value });
+      } catch (e) {
+        rejection = String(e && e.message ? e.message : e);
+      }
+      record(
+        mode,
+        'override',
+        `invalid runtime nonce (${label}) rejected with an actionable error`,
+        rejection.includes('handleRequest options.nonce') && rejection.includes(expected),
+        rejection.slice(0, 200) || 'resolved without error',
+      );
+    }
+    const transformed = await probe.environments.ssr.transformRequest('virtual:solid-ssr-handler');
+    record(
+      mode,
+      'codegen',
+      'no nonce module import without the option',
+      !!transformed && !transformed.code.includes('nonce.ts'),
+    );
+  } catch (e) {
+    record(mode, 'override', 'direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+  }
+
+  // ---- Direct dispatch: the module, after the middleware chain -------------
+  const moduleEnv = { SSR_NONCE: 'module', SSR_MIDDLEWARE: '1' };
+  Object.assign(process.env, moduleEnv);
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const viaModule = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }))
+    ).text();
+    const moduleCheck = everyTagCarries(viaModule, 'from-locals');
+    record(
+      mode,
+      'module',
+      'module reads the nonce the middleware stored on event.locals',
+      moduleCheck.ok,
+      moduleCheck.detail,
+    );
+    const overridden = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), { nonce: 'from-option' })
+    ).text();
+    record(
+      mode,
+      'module',
+      'handleRequest({ nonce }) beats the module (precedence)',
+      everyTagCarries(overridden, 'from-option').ok && !overridden.includes('from-locals'),
+    );
+    record(
+      mode,
+      'module',
+      'module returning undefined leaves the document without a nonce',
+      carriesNone(await (await handler.handleRequest(page())).text()),
+    );
+    const transformed = await probe.environments.ssr.transformRequest('virtual:solid-ssr-handler');
+    record(
+      mode,
+      'codegen',
+      'handler imports the configured nonce module',
+      !!transformed && transformed.code.includes('nonce.ts'),
+    );
+  } catch (e) {
+    record(mode, 'module', 'module-config direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    for (const key of Object.keys(moduleEnv)) delete process.env[key];
+  }
+
+  // ---- Direct dispatch: start.setup renders through its own path ------------
+  process.env.SSR_SETUP = '1';
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const withSetup = await (await handler.handleRequest(page(), { nonce: 'setup-nonce' })).text();
+    const setupCheck = everyTagCarries(withSetup, 'setup-nonce');
+    record(mode, 'setup', 'start.setup render carries the nonce', setupCheck.ok, setupCheck.detail);
+  } catch (e) {
+    record(mode, 'setup', 'setup direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    delete process.env.SSR_SETUP;
+  }
+
+  // ---- Built handler --------------------------------------------------------
+  try {
+    console.log('  building (nonce module)…');
+    build(moduleEnv);
+    const built = await import(
+      pathToFileURL(path.join(exampleDir, 'dist/server/server.js')).href + `?nonce=${Date.now()}`
+    );
+    const prodHtml = await (
+      await built.handleRequest(page({ 'x-csp-nonce': 'prod-nonce' }))
+    ).text();
+    const prodCheck = everyTagCarries(prodHtml, 'prod-nonce');
+    record(
+      mode,
+      'prod',
+      'built handler stamps every script and modulepreload',
+      prodCheck.ok && prodHtml.includes('rel="modulepreload"'),
+      prodCheck.detail,
+    );
+    const fetchHtml = await (
+      await built.default.fetch(page({ 'x-csp-nonce': 'fetch-nonce' }))
+    ).text();
+    const fetchCheck = everyTagCarries(fetchHtml, 'fetch-nonce');
+    record(
+      mode,
+      'prod',
+      'default Fetchable (no options) resolves the nonce through the module',
+      fetchCheck.ok,
+      fetchCheck.detail,
+    );
+  } catch (e) {
+    record(mode, 'prod', 'built handler dispatch completed', false, String(e));
+  } finally {
+    // Leave dist in the standard state for anyone poking at it.
+    try {
+      build();
+    } catch {}
+  }
+}
+
 const ALL_MODES = [
   'dev',
   'prod',
@@ -5904,6 +6184,7 @@ const ALL_MODES = [
   'middleware',
   'preview',
   'render-mode',
+  'nonce',
   'base',
   'builder-order',
   'builder-prepare',
@@ -5931,6 +6212,7 @@ for (const mode of modes) {
   else if (mode === 'middleware') await runMiddlewareMode();
   else if (mode === 'preview') await runPreviewMode();
   else if (mode === 'render-mode') await runRenderModeMode();
+  else if (mode === 'nonce') await runNonceMode();
   else if (mode === 'base') await runBaseMode();
   else if (mode === 'builder-order') await runBuilderOrderMode();
   else if (mode === 'builder-prepare') await runBuilderPrepareMode();
diff --git a/examples/start-ssr/vite.config.ts b/examples/start-ssr/vite.config.ts
index fa74b14d..4439be08 100644
--- a/examples/start-ssr/vite.config.ts
+++ b/examples/start-ssr/vite.config.ts
@@ -39,6 +39,9 @@ import solidPlugin from '@solidjs/vite-plugin';
 //   `?nojs`); any other value passes through verbatim — `async` for the
 //   static complete-document mode, and bogus literals or missing paths for
 //   the config-validation assertions.
+// - SSR_NONCE sets `start.nonce` (nonce mode): `module` wires src/nonce.ts
+//   (reads the nonce the middleware stored on `event.locals`); any other
+//   value passes through verbatim for the config-validation assertions.
 // - SERVER_FN_DEV_MIDDLEWARE=0 disables the built-in dev middleware via
 //   `serverFunctions.devMiddleware` (no-middleware mode) — endpoint dispatch
 //   becomes the host's job, like a Cloudflare-style environment plugin.
@@ -217,6 +220,15 @@ export default defineConfig({
                         : process.env.SSR_RENDER_MODE,
                   }
                 : {}),
+              // SSR_NONCE (nonce mode): `module` → the per-request CSP
+              // nonce module; anything else verbatim (a missing path for the
+              // validation check).
+              ...(process.env.SSR_NONCE
+                ? {
+                    nonce:
+                      process.env.SSR_NONCE === 'module' ? './src/nonce.ts' : process.env.SSR_NONCE,
+                  }
+                : {}),
             },
       serverFunctions: serverComponents
         ? { components: true }
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 8fb6bb86..99944db6 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -36,6 +36,10 @@
 //   behind it; `'async'` awaits the settled document (no fallbacks or swap
 //   scripts — complete for no-JS clients); a module path decides per
 //   request, and `handleRequest(request, { renderMode })` overrides both.
+// - `start.nonce` names a module that resolves the request's CSP nonce
+//   after the middleware chain; the handler hands it to the render (every
+//   runtime script and preload), the client-entry tag and the post-flush
+//   redirect fallback, and `handleRequest(request, { nonce })` overrides it.
 // - `vite preview` serves dist/client statically and dispatches everything
 //   else through the built handler — the production path, middleware
 //   included, with no server file needed.
@@ -257,6 +261,35 @@ export interface StartOptions {
    * @default 'stream'
    */
   renderMode?: 'stream' | 'async' | (string & {});
+  /**
+   * Path to a server-only module (resolved relative to the Vite root,
+   * following the `middleware`/`setup`/`renderMode` convention) whose
+   * default export resolves the CSP nonce of a page request: `(event) =>
+   * CSPNonce | undefined | Promise<CSPNonce | undefined>`, where `CSPNonce`
+   * is `@solidjs/web`'s `string | { script: string | false; style: string |
+   * false }`. Called per request inside the request scope after the
+   * middleware chain, so the usual recipe is a middleware that generates
+   * the nonce, stores it on `event.locals` and sets the
+   * `Content-Security-Policy` header, plus a module returning
+   * `event.locals.nonce`.
+   *
+   * The handler passes the resolved nonce to `renderToStream` in the
+   * generated entry — the hydration bootstrap, the streamed data and swap
+   * scripts and the `modulepreload` links all carry it — and to the
+   * injected client-entry tag and the post-flush redirect fallback (in
+   * dev, also to the head tags the handler injects: the style patch and
+   * Vite client scripts, the collected styles and a `csp-nonce` meta for
+   * the Vite client). Authored entries receive it as `context.nonce` in
+   * `render()`. Inline scripts the app's own `Document` renders still read
+   * it themselves (e.g. `getRequestEvent()?.locals.nonce`).
+   *
+   * Hosts driving the handler directly can override it per call with
+   * `handleRequest(request, { nonce })`. Server mode only — ignored in
+   * client mode, whose shell is prerendered once at build time.
+   *
+   * @default undefined
+   */
+  nonce?: string;
   /**
    * Typed, validated environment variables. A schema file — conventionally
    * `env.ts` (or `env.js`) at the project root, probed automatically —
@@ -521,6 +554,26 @@ function resolveRenderMode(
   };
 }
 
+/**
+ * Resolves `start.nonce` at config time to the absolute path of the
+ * per-request module. Only a path is accepted: a nonce is per request by
+ * definition, and a Vite config cannot serialize a closure into the
+ * generated handler.
+ */
+function resolveNonceModule(root: string, value: StartOptions['nonce']): string | null {
+  if (value === undefined) return null;
+  if (typeof value !== 'string') {
+    throw new Error(
+      `[@solidjs/vite-plugin] start.nonce must be the path of a module (relative to the Vite ` +
+        `root) default-exporting a per-request function ((event) => CSPNonce | undefined | ` +
+        `Promise<...>); got ${typeof value}. A Vite config cannot serialize a closure into the ` +
+        `generated handler — put the function in a module (e.g. ./src/nonce.ts) and pass its ` +
+        `path instead.`,
+    );
+  }
+  return path.resolve(root, normalizeUserPath(root, value, 'nonce'));
+}
+
 interface ResolvedEntries {
   /** Root-relative path or virtual id. */
   entryServer: string;
@@ -730,6 +783,8 @@ export function startServe(
    */
   let renderMode: RenderMode = 'stream';
   let renderModePath: string | null = null;
+  /** Absolute path of the per-request CSP nonce module, when configured (server mode). */
+  let noncePath: string | null = null;
 
   function requireEntries(): ResolvedEntries {
     // config() always runs before resolveId/load/configureServer.
@@ -924,12 +979,15 @@ export function startServe(
               `  </DefaultErrorBoundary>`,
             ]
           : [`  <Document />`]),
-        `  ), { manifest });`,
+        `  ), { manifest, nonce: context && context.nonce });`,
         `}`,
       ].join('\n');
     }
     const { app } = requireEntries();
-    const streamOptions = `{ manifest${serverComponents ? ', plugins: [ServerComponentPlugin]' : ''} }`;
+    // `context.nonce` is the request's CSP nonce resolved by the handler
+    // (`start.nonce` or `handleRequest(request, { nonce })`): renderToStream
+    // stamps it on every script and preload the runtime emits.
+    const streamOptions = `{ manifest, nonce: context && context.nonce${serverComponents ? ', plugins: [ServerComponentPlugin]' : ''} }`;
     return [
       `import { renderToStream${setupPath ? ', getRequestEvent' : ''} } from '@solidjs/web';`,
       ...(serverComponents
@@ -977,12 +1035,12 @@ export function startServe(
             `export function render(request, context) {`,
             `  const prepared = setup(getRequestEvent(), App);`,
             `  if (prepared && typeof prepared.then === 'function') {`,
-            `    return prepared.then((component) => ({ ${STREAM_BOX}: renderApp(component || App) }));`,
+            `    return prepared.then((component) => ({ ${STREAM_BOX}: renderApp(component || App, context) }));`,
             `  }`,
-            `  return renderApp(prepared || App);`,
+            `  return renderApp(prepared || App, context);`,
             `}`,
             ``,
-            `function renderApp(Root) {`,
+            `function renderApp(Root, context) {`,
             `  return renderToStream(() => (`,
             ...documentTree('Root', toolbar ? 'DevToolbar' : undefined),
             `  ), ${streamOptions});`,
@@ -1149,7 +1207,7 @@ export function startServe(
     const composeServerFunctions = internal.serverFunctions;
 
     const lines = [
-      `import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
+      `import { createRequestEvent, createSSRResponse, commitEventResponse, scriptNonce${isBuild ? '' : ', styleNonce'}${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
       `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`,
       `import * as entry from ${JSON.stringify(entryServerSpec())};`,
       ...(middlewarePath
@@ -1158,6 +1216,7 @@ export function startServe(
       ...(renderModePath
         ? [`import renderModeModule from ${JSON.stringify(renderModePath)};`]
         : []),
+      ...(noncePath ? [`import nonceModule from ${JSON.stringify(noncePath)};`] : []),
       ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []),
       ...(composeServerFunctions
         ? [
@@ -1201,10 +1260,23 @@ export function startServe(
         `}`,
       );
     } else {
-      const devHead =
-        `<script>${devStylePatch}</script>` +
-        `<script type="module" src="${joinBase(base, '/@vite/client')}"></script>`;
-      lines.push(``, `const DEV_HEAD = ${JSON.stringify(devHead)};`);
+      // Functions of the request's nonce attributes: under a nonce-based
+      // CSP the two scripts carry the script nonce (`'strict-dynamic'` then
+      // trusts the modules the Vite client loads), the collected dev styles
+      // carry the style nonce, and the `csp-nonce` meta hands the style
+      // nonce to the Vite client for the styles it injects on HMR.
+      lines.push(
+        ``,
+        `function devHead(nonceAttr, styleAttr) {`,
+        `  return (styleAttr ? '<meta property="csp-nonce"' + styleAttr + '>' : '') +`,
+        `    '<script' + nonceAttr + '>' + ${JSON.stringify(devStylePatch)} + '</' + 'script>' +`,
+        `    '<script type="module"' + nonceAttr + ' src=' + ${JSON.stringify(JSON.stringify(joinBase(base, '/@vite/client')))} + '></' + 'script>';`,
+        `}`,
+        ``,
+        `function devStyles(html, styleAttr) {`,
+        `  return styleAttr ? html.split('<style data-asset=').join('<style' + styleAttr + ' data-asset=') : html;`,
+        `}`,
+      );
     }
 
     // Middleware: the user module default-exports one fetch-style function
@@ -1262,6 +1334,49 @@ export function startServe(
       );
     }
 
+    // CSP nonce (`start.nonce`): the `handleRequest` option wins, then the
+    // configured module's per-request result. Both take @solidjs/web's
+    // `CSPNonce` shape — a string for every destination, or a
+    // `{ script, style }` pair — and an empty result means no nonce.
+    lines.push(
+      ``,
+      `function assertNonce(nonce, source) {`,
+      `  if (nonce == null || typeof nonce === 'string') return nonce || undefined;`,
+      // A plain `{ script, style }` object and nothing else: a typo'd key or
+      // an array would otherwise normalize to "no nonce" without a word.
+      `  const prototype = typeof nonce === 'object' ? Object.getPrototypeOf(nonce) : undefined;`,
+      `  const destination = (value) => value === undefined || value === false || typeof value === 'string';`,
+      `  if (`,
+      `    (prototype === Object.prototype || prototype === null) &&`,
+      `    Object.keys(nonce).every((key) => key === 'script' || key === 'style') &&`,
+      `    destination(nonce.script) &&`,
+      `    destination(nonce.style)`,
+      `  ) {`,
+      `    return nonce;`,
+      `  }`,
+      `  const got = Array.isArray(nonce) ? 'an array' : prototype ? 'an object with keys ' + JSON.stringify(Object.keys(nonce)) : typeof nonce;`,
+      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object of strings (or false), or undefined; got ' + got);`,
+      `}`,
+    );
+    if (noncePath) {
+      lines.push(
+        `if (typeof nonceModule !== 'function') {`,
+        `  throw new Error('[@solidjs/vite-plugin] start.nonce must default-export a function ' +`,
+        `    '((event) => CSPNonce | undefined | Promise<...>): ' + ${JSON.stringify(noncePath)});`,
+        `}`,
+        `async function resolveNonce(event, options) {`,
+        `  if (options.nonce !== undefined) return assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `  return assertNonce(await nonceModule(event), 'the start.nonce module (' + ${JSON.stringify(noncePath)} + ') result');`,
+        `}`,
+      );
+    } else {
+      lines.push(
+        `function resolveNonce(event, options) {`,
+        `  return assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `}`,
+      );
+    }
+
     // No `_$SC` bootstrap injection: the runtime's serialized
     // server-component references self-bootstrap the registry (each
     // hydration script's first reference carries it as an idempotent
@@ -1276,7 +1391,16 @@ export function startServe(
       `}`,
       ``,
       `function createHtmlChunkTransform(clientEntry, extraHead, nonce) {`,
-      `  const nonceAttr = nonce ? ' nonce="' + escapeAttribute(nonce) + '"' : '';`,
+      // The client entry is a script: take the script destination of a
+      // `{ script, style }` pair instead of escaping the object itself.
+      `  const scriptValue = scriptNonce(nonce);`,
+      `  const nonceAttr = scriptValue ? ' nonce="' + escapeAttribute(scriptValue) + '"' : '';`,
+      ...(isBuild
+        ? []
+        : [
+            `  const styleValue = styleNonce(nonce);`,
+            `  const styleAttr = styleValue ? ' nonce="' + escapeAttribute(styleValue) + '"' : '';`,
+          ]),
       `  let first = true;`,
       `  let injected = false;`,
       `  return (chunk) => {`,
@@ -1308,10 +1432,10 @@ export function startServe(
     // styles or the external environment's HMR-tracked virtual styles module.
     if (!isBuild) {
       headParts.push(
-        `DEV_HEAD`,
+        `devHead(nonceAttr, styleAttr)`,
         externalDev
-          ? `(extraHead === undefined ? DEV_STYLES_HEAD : extraHead)`
-          : `(extraHead || '')`,
+          ? `devStyles(extraHead === undefined ? DEV_STYLES_HEAD : extraHead, styleAttr)`
+          : `devStyles(extraHead || '', styleAttr)`,
       );
     }
     if (generated || clientMode) {
@@ -1391,7 +1515,10 @@ export function startServe(
       // inside the request scope and after the middleware chain, so a
       // per-request policy sees the decorated event.
       `  const renderMode = await resolveRenderMode(event, options);`,
-      `  let result = entry.render(request, { clientEntry, ...options.context });`,
+      // Same window for the nonce: after the chain, so a middleware that
+      // generated it (and set the CSP header) has stored it on `locals`.
+      `  const nonce = ${noncePath ? 'await ' : ''}resolveNonce(event, options);`,
+      `  let result = entry.render(request, { clientEntry, nonce, ...options.context });`,
       // renderToStream results are thenables whose then() waits for the
       // *complete* render — check for pipe first so streaming survives, and
       // only await plain promises (async render functions).
@@ -1425,8 +1552,8 @@ export function startServe(
       // script fallback; the transform injects the doctype/head pieces.
       `  return createSSRResponse(result, event, {`,
       `    responseInit: options.responseInit,`,
-      `    nonce: options.nonce,`,
-      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, options.nonce),`,
+      `    nonce: scriptNonce(nonce),`,
+      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, nonce),`,
       `  });`,
       `}`,
       ``,
@@ -1507,6 +1634,12 @@ export function startServe(
           renderMode = 'stream';
           renderModePath = null;
         }
+        // Server-mode only too: the client-mode shell is prerendered once,
+        // so a per-request nonce has nowhere to go. Validated in every mode
+        // like `renderMode`. Authored entries are fine — they receive the
+        // value as `context.nonce`.
+        noncePath = resolveNonceModule(root, options.nonce);
+        if (clientMode) noncePath = null;
         if (env.isPreview) {
           if (clientMode) {
             // Client-mode builds emit a real dist/client/index.html (the
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index f26db65f..c9d53b48 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -59,6 +59,17 @@ declare module "virtual:solid-ssr-handler" {
        * `Location` becomes a real 3xx under `'async'`.
        */
       renderMode?: 'stream' | 'async';
+      /**
+       * Per-call CSP nonce, overriding `start.nonce` — `@solidjs/web`'s
+       * `CSPNonce`. A string applies to scripts and styles; a
+       * `{ script, style }` object routes each destination, with `false`
+       * leaving it un-nonced. Reaches the
+       * generated entry's `renderToStream` (hydration, streamed data and
+       * swap scripts, `modulepreload` links), the injected client-entry tag
+       * and the post-flush redirect fallback; authored entries receive it
+       * as `context.nonce`.
+       */
+      nonce?: string | { script: string | false; style: string | false };
       /**
        * Extra fields spread into the request event at creation — the public
        * wrapper→event extension seam. Conventionally `nativeEvent` carries

From 85423195e7963a0c523b7712fbeaf261c9635330 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Fri, 2 Oct 2026 23:59:10 -0300
Subject: [PATCH 02/13] fix: keep options.context from overriding the resolved
 nonce

The handler built the render context as `{ clientEntry, nonce,
...options.context }`, so a host passing `context.nonce` gave the render
one nonce while the client-entry tag and the redirect fallback got
another. The resolved nonce now goes last. The nonce mode checks it with
conflicting values: 18/19 before, 19/19 after.
---
 examples/start-ssr/test/run.mjs | 20 ++++++++++++++++++--
 src/ssr/index.ts                | 20 +++++++++++---------
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index 4f58e1c7..8f854ecd 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -5899,13 +5899,13 @@ async function runVitestMode() {
 //   swap scripts, the client entry, the dev head) and every modulepreload
 //   link carries it, escaped, and so does the post-flush redirect fallback;
 //   the `{ script, style }` form works (it used to throw building the entry
-//   tag) and an invalid value — a primitive, an array, a typo'd key — is
+//   tag) and an invalid value (a primitive, an array, a typo'd key) is
 //   rejected,
 // - dev head: the collected styles carry the style nonce and a `csp-nonce`
 //   meta hands it to the Vite client,
 // - `start.setup` renders with the nonce too (its own render path),
 // - the module form (src/nonce.ts) resolves the nonce after the middleware
-//   chain — it reads what src/middleware.ts stored on `event.locals` — and
+//   chain (it reads what src/middleware.ts stored on `event.locals`), and
 //   the runtime option still wins over it,
 // - the built handler does the same through both `handleRequest` and the
 //   default Fetchable (the path hosts like Nitro dispatch through, which
@@ -5995,6 +5995,22 @@ async function runNonceMode() {
       objectResponse.status === 200 && objectCheck.ok,
       `status ${objectResponse.status}, ${objectCheck.detail}`,
     );
+    // A host's `context` must not hand the render a different nonce from the
+    // one the client-entry tag and the redirect fallback get.
+    const contextForm = await (
+      await handler.handleRequest(page(), {
+        nonce: 'option-nonce',
+        context: { nonce: 'context-nonce' },
+      })
+    ).text();
+    const contextCheck = everyTagCarries(contextForm, 'option-nonce');
+    record(
+      mode,
+      'override',
+      'options.context.nonce does not override the resolved nonce',
+      contextCheck.ok && !contextForm.includes('context-nonce'),
+      contextCheck.detail,
+    );
     record(
       mode,
       'override',
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 99944db6..ae55ec68 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -274,8 +274,8 @@ export interface StartOptions {
    * `event.locals.nonce`.
    *
    * The handler passes the resolved nonce to `renderToStream` in the
-   * generated entry — the hydration bootstrap, the streamed data and swap
-   * scripts and the `modulepreload` links all carry it — and to the
+   * generated entry, so the hydration bootstrap, the streamed data and swap
+   * scripts and the `modulepreload` links all carry it. It also reaches the
    * injected client-entry tag and the post-flush redirect fallback (in
    * dev, also to the head tags the handler injects: the style patch and
    * Vite client scripts, the collected styles and a `csp-nonce` meta for
@@ -284,8 +284,8 @@ export interface StartOptions {
    * it themselves (e.g. `getRequestEvent()?.locals.nonce`).
    *
    * Hosts driving the handler directly can override it per call with
-   * `handleRequest(request, { nonce })`. Server mode only — ignored in
-   * client mode, whose shell is prerendered once at build time.
+   * `handleRequest(request, { nonce })`. Server mode only: client mode
+   * ignores it, since its shell is prerendered once at build time.
    *
    * @default undefined
    */
@@ -567,7 +567,7 @@ function resolveNonceModule(root: string, value: StartOptions['nonce']): string
       `[@solidjs/vite-plugin] start.nonce must be the path of a module (relative to the Vite ` +
         `root) default-exporting a per-request function ((event) => CSPNonce | undefined | ` +
         `Promise<...>); got ${typeof value}. A Vite config cannot serialize a closure into the ` +
-        `generated handler — put the function in a module (e.g. ./src/nonce.ts) and pass its ` +
+        `generated handler, so put the function in a module (e.g. ./src/nonce.ts) and pass its ` +
         `path instead.`,
     );
   }
@@ -1336,8 +1336,8 @@ export function startServe(
 
     // CSP nonce (`start.nonce`): the `handleRequest` option wins, then the
     // configured module's per-request result. Both take @solidjs/web's
-    // `CSPNonce` shape — a string for every destination, or a
-    // `{ script, style }` pair — and an empty result means no nonce.
+    // `CSPNonce` shape (a string for every destination, or a
+    // `{ script, style }` pair), and an empty result means no nonce.
     lines.push(
       ``,
       `function assertNonce(nonce, source) {`,
@@ -1517,8 +1517,10 @@ export function startServe(
       `  const renderMode = await resolveRenderMode(event, options);`,
       // Same window for the nonce: after the chain, so a middleware that
       // generated it (and set the CSP header) has stored it on `locals`.
+      // It goes after `options.context` so the render can't get a different
+      // value from the one the client-entry tag and the redirect fallback get.
       `  const nonce = ${noncePath ? 'await ' : ''}resolveNonce(event, options);`,
-      `  let result = entry.render(request, { clientEntry, nonce, ...options.context });`,
+      `  let result = entry.render(request, { clientEntry, ...options.context, nonce });`,
       // renderToStream results are thenables whose then() waits for the
       // *complete* render — check for pipe first so streaming survives, and
       // only await plain promises (async render functions).
@@ -1636,7 +1638,7 @@ export function startServe(
         }
         // Server-mode only too: the client-mode shell is prerendered once,
         // so a per-request nonce has nowhere to go. Validated in every mode
-        // like `renderMode`. Authored entries are fine — they receive the
+        // like `renderMode`. Authored entries are fine: they receive the
         // value as `context.nonce`.
         noncePath = resolveNonceModule(root, options.nonce);
         if (clientMode) noncePath = null;

From b9fe1a37bedab83c7c5e2338ff71257642207407 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Fri, 2 Oct 2026 23:59:10 -0300
Subject: [PATCH 03/13] docs: type the nonce option with @solidjs/web's
 CSPNonce

Declare `nonce` on the handleRequest options through
`import type { CSPNonce } from "@solidjs/web"` instead of an inline copy
of the type, next to `responseInit`, and tighten the README section and
the changeset.
---
 .changeset/start-csp-nonce.md |  4 ++--
 README.md                     | 23 +++++++++++------------
 virtual-solid-manifest.d.ts   | 24 +++++++++++++-----------
 3 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
index 3e2a6706..a334764b 100644
--- a/.changeset/start-csp-nonce.md
+++ b/.changeset/start-csp-nonce.md
@@ -2,6 +2,6 @@
 '@solidjs/vite-plugin': minor
 ---
 
-`start.nonce`: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>` that resolves the request's CSP nonce inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The handler passes the resolved nonce to the generated entry's `renderToStream` — the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links now carry it — as well as to the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Until now generated entries rendered without a nonce, so a strict `script-src 'nonce-…'` policy required hand-written `entry-server` / `entry-client` files (and gave up the generated error boundary). `handleRequest(request, { nonce })` keeps working as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
+New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
 
-Also fixes the object form of the nonce: `handleRequest(request, { nonce: { script, style } })` threw `TypeError: value.replace is not a function` while building the client-entry tag. The tag and the redirect fallback now take the script destination through `@solidjs/web`'s `scriptNonce`, and an invalid nonce from either source (including an array or an object with keys other than `script` / `style`) is rejected with an error naming it.
+An invalid nonce from either source (a primitive other than a string, an array, or an object with keys other than `script` / `style`) is rejected with an error naming its source.
diff --git a/README.md b/README.md
index cc01a82d..41758703 100644
--- a/README.md
+++ b/README.md
@@ -620,18 +620,17 @@ export default function nonce(event: RequestEvent) {
 
 The handler passes the resolved nonce to the generated entry's
 `renderToStream`, so the hydration bootstrap, the streamed data and swap
-scripts and the `modulepreload` links all carry it, and to the injected
-client-entry tag and the post-flush redirect fallback — in dev as well, where
-the head tags the handler injects carry it too: the style patch and Vite
-client scripts (with `'strict-dynamic'`, the modules they load are trusted in
-turn), the collected styles, and a `csp-nonce` meta the Vite client reads for
-the styles it injects. Inline scripts your
-own `Document` renders still need it spelled out
-(`nonce={getRequestEvent()?.locals.nonce}`). Authored entries receive the
-value as `context.nonce` in `render()`. Hosts driving the handler directly
-can pass `handleRequest(request, { nonce })`, which wins over the module.
-Server mode only — the client-mode shell is prerendered once at build time,
-so there is no request to take a nonce from.
+scripts and the `modulepreload` links all carry it. The injected client-entry
+tag and the post-flush redirect fallback get it too, in dev as well, where the
+head tags the handler injects also carry it: the style patch and Vite client
+scripts (with `'strict-dynamic'`, the modules they load are trusted in turn),
+the collected styles, and a `csp-nonce` meta the Vite client reads for the
+styles it injects. Inline scripts your own `Document` renders still need it
+spelled out (`nonce={getRequestEvent()?.locals.nonce}`). Authored entries
+receive the value as `context.nonce` in `render()`. Hosts driving the handler
+directly can pass `handleRequest(request, { nonce })`, which wins over the
+module. Server mode only: the client-mode shell is prerendered once at build
+time, so there is no request to take a nonce from.
 
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index c9d53b48..d6c81a51 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -40,6 +40,8 @@ declare module "virtual:solid-server-function-handler" {
 // manifest, and — when `serverFunctions` is enabled — serves the
 // server-function endpoint ahead of SSR.
 declare module "virtual:solid-ssr-handler" {
+  import type { CSPNonce } from "@solidjs/web";
+
   export function handleRequest(
     request: Request,
     options?: {
@@ -49,6 +51,17 @@ declare module "virtual:solid-ssr-handler" {
       context?: Record<string, unknown>;
       /** Status/headers for the HTML response. */
       responseInit?: ResponseInit;
+      /**
+       * Per-call CSP nonce, overriding `start.nonce`, in `@solidjs/web`'s
+       * `CSPNonce` shape. A string applies to scripts and styles; a
+       * `{ script, style }` pair routes each destination, with `false`
+       * leaving it un-nonced. It reaches the generated entry's
+       * `renderToStream` (hydration, streamed data and swap scripts,
+       * `modulepreload` links), the injected client-entry tag and the
+       * post-flush redirect fallback; authored entries receive it as
+       * `context.nonce`.
+       */
+      nonce?: CSPNonce;
       /**
        * Per-call render mode, overriding `start.renderMode` (static value or
        * per-request module alike). `'stream'` flushes the document shell
@@ -59,17 +72,6 @@ declare module "virtual:solid-ssr-handler" {
        * `Location` becomes a real 3xx under `'async'`.
        */
       renderMode?: 'stream' | 'async';
-      /**
-       * Per-call CSP nonce, overriding `start.nonce` — `@solidjs/web`'s
-       * `CSPNonce`. A string applies to scripts and styles; a
-       * `{ script, style }` object routes each destination, with `false`
-       * leaving it un-nonced. Reaches the
-       * generated entry's `renderToStream` (hydration, streamed data and
-       * swap scripts, `modulepreload` links), the injected client-entry tag
-       * and the post-flush redirect fallback; authored entries receive it
-       * as `context.nonce`.
-       */
-      nonce?: string | { script: string | false; style: string | false };
       /**
        * Extra fields spread into the request event at creation — the public
        * wrapper→event extension seam. Conventionally `nativeEvent` carries

From 970bc192e09514dcff85259790b232c909174b11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 00:12:47 -0300
Subject: [PATCH 04/13] fix: accept the { script, style } CSP nonce in
 handleRequest

The generated handler passed `options.nonce` unchanged to the
client-entry transform, whose `escapeAttribute` calls `.replace` on it,
and to `createSSRResponse`, which takes a string, so a `{ script, style }`
nonce threw `TypeError: value.replace is not a function`. Project it with
`scriptNonce` for both, and declare the option in the
`virtual:solid-ssr-handler` types.
---
 .changeset/handle-request-nonce-pair.md |  5 +++
 examples/start-ssr/test/run.mjs         | 56 +++++++++++++++++++++++++
 src/ssr/index.ts                        | 10 +++--
 virtual-solid-manifest.d.ts             |  9 ++++
 4 files changed, 77 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/handle-request-nonce-pair.md

diff --git a/.changeset/handle-request-nonce-pair.md b/.changeset/handle-request-nonce-pair.md
new file mode 100644
index 00000000..0f1d279a
--- /dev/null
+++ b/.changeset/handle-request-nonce-pair.md
@@ -0,0 +1,5 @@
+---
+'@solidjs/vite-plugin': patch
+---
+
+`handleRequest(request, { nonce })` accepts the `{ script, style }` form of `@solidjs/web`'s `CSPNonce` and uses its `script` value for the scripts the handler writes: the injected client-entry tag and the post-flush redirect fallback. A pair used to throw `TypeError: value.replace is not a function`. The option is now declared in the `virtual:solid-ssr-handler` types.
diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index a06cf87d..f5007d41 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -388,6 +388,17 @@ function record(mode, phase, name, ok, detail = '') {
   console.log(`  [${mode}/${phase}] ${status} ${name}${detail && !ok ? ` — ${detail}` : ''}`);
 }
 
+// Reads a handler call's whole body; a rejection becomes the assertion's
+// detail instead of aborting the whole run.
+async function settledText(call) {
+  try {
+    const response = await call();
+    return { text: await response.text(), error: '' };
+  } catch (error) {
+    return { text: '', error: String(error) };
+  }
+}
+
 // Pull the function id for `name` out of the client-transformed module so
 // the endpoint can be hit directly.
 function extractFunctionId(transformedCode, name) {
@@ -1446,6 +1457,51 @@ async function runProdMode() {
     'client entry carries the escaped CSP nonce',
     nonceHtml.includes('<script type="module" nonce="test&quot;&lt;&amp;" src="'),
   );
+  // @solidjs/web's CSPNonce also takes a `{ script, style }` pair. The tags
+  // the handler writes are scripts, so they take the `script` value.
+  const pairNonce = { script: 'pair-script', style: 'pair-style' };
+  const pairPage = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/'), { nonce: pairNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'client entry takes the script nonce of a { script, style } pair',
+    pairPage.text.includes('<script type="module" nonce="pair-script" src="') &&
+      !/<script\b[^>]*nonce="pair-style"/.test(pairPage.text),
+    pairPage.error,
+  );
+  const pairRedirect = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/redirect-post'), { nonce: pairNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'post-flush redirect fallback takes the script nonce of a { script, style } pair',
+    pairRedirect.text.includes('<script nonce="pair-script">window.location='),
+    pairRedirect.error,
+  );
+  const styleOnlyNonce = { script: false, style: 'pair-style' };
+  const styleOnlyPage = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/'), { nonce: styleOnlyNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'a pair without a script nonce leaves the client entry un-nonced',
+    styleOnlyPage.text.includes('<script type="module" src="'),
+    styleOnlyPage.error,
+  );
+  const styleOnlyRedirect = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/redirect-post'), { nonce: styleOnlyNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'a pair without a script nonce leaves the redirect fallback un-nonced',
+    styleOnlyRedirect.text.includes('<script>window.location='),
+    styleOnlyRedirect.error,
+  );
   record(
     mode,
     'build',
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 8fb6bb86..aeb0eabb 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -1149,7 +1149,7 @@ export function startServe(
     const composeServerFunctions = internal.serverFunctions;
 
     const lines = [
-      `import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
+      `import { createRequestEvent, createSSRResponse, commitEventResponse, scriptNonce${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
       `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`,
       `import * as entry from ${JSON.stringify(entryServerSpec())};`,
       ...(middlewarePath
@@ -1423,10 +1423,14 @@ export function startServe(
       // The runtime's response-head lifecycle: commit at shell flush,
       // pre-flush Location as a real redirect, post-flush Location as the
       // script fallback; the transform injects the doctype/head pieces.
+      // Both write a single script, so a `{ script, style }` nonce
+      // contributes its script value, as with @solidjs/web's other
+      // single-script surfaces.
+      `  const nonce = scriptNonce(options.nonce);`,
       `  return createSSRResponse(result, event, {`,
       `    responseInit: options.responseInit,`,
-      `    nonce: options.nonce,`,
-      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, options.nonce),`,
+      `    nonce,`,
+      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, nonce),`,
       `  });`,
       `}`,
       ``,
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index f26db65f..20d7a316 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -40,6 +40,8 @@ declare module "virtual:solid-server-function-handler" {
 // manifest, and — when `serverFunctions` is enabled — serves the
 // server-function endpoint ahead of SSR.
 declare module "virtual:solid-ssr-handler" {
+  import type { CSPNonce } from "@solidjs/web";
+
   export function handleRequest(
     request: Request,
     options?: {
@@ -49,6 +51,13 @@ declare module "virtual:solid-ssr-handler" {
       context?: Record<string, unknown>;
       /** Status/headers for the HTML response. */
       responseInit?: ResponseInit;
+      /**
+       * CSP nonce for the scripts the handler writes into the document: the
+       * injected client-entry tag and the fallback of a redirect decided
+       * after the shell flushed. A `{ script, style }` pair contributes its
+       * `script` value.
+       */
+      nonce?: CSPNonce;
       /**
        * Per-call render mode, overriding `start.renderMode` (static value or
        * per-request module alike). `'stream'` flushes the document shell

From 57cf3b2dc486fa42be1aa6f0351c8ff4e76d49bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:08:44 -0300
Subject: [PATCH 05/13] fix: require both keys in a { script, style } nonce

The CSPNonce type has both destinations. `{}` and `{ script: 'x' }` passed
validation and left a destination without a nonce; they're now rejected
with the error that names the source.
---
 .changeset/start-csp-nonce.md | 2 +-
 src/ssr/index.ts              | 9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
index a334764b..f4f7f95b 100644
--- a/.changeset/start-csp-nonce.md
+++ b/.changeset/start-csp-nonce.md
@@ -4,4 +4,4 @@
 
 New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
 
-An invalid nonce from either source (a primitive other than a string, an array, or an object with keys other than `script` / `style`) is rejected with an error naming its source.
+An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index c8f9bea9..d90e1131 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -1342,10 +1342,11 @@ export function startServe(
       ``,
       `function assertNonce(nonce, source) {`,
       `  if (nonce == null || typeof nonce === 'string') return nonce || undefined;`,
-      // A plain `{ script, style }` object and nothing else: a typo'd key or
-      // an array would otherwise normalize to "no nonce" without a word.
+      // A plain object with both destinations and nothing else, as the
+      // `CSPNonce` type has it: a missing or typo'd key or an array would
+      // otherwise leave a destination without a nonce without a word.
       `  const prototype = typeof nonce === 'object' ? Object.getPrototypeOf(nonce) : undefined;`,
-      `  const destination = (value) => value === undefined || value === false || typeof value === 'string';`,
+      `  const destination = (value) => value === false || typeof value === 'string';`,
       `  if (`,
       `    (prototype === Object.prototype || prototype === null) &&`,
       `    Object.keys(nonce).every((key) => key === 'script' || key === 'style') &&`,
@@ -1355,7 +1356,7 @@ export function startServe(
       `    return nonce;`,
       `  }`,
       `  const got = Array.isArray(nonce) ? 'an array' : prototype ? 'an object with keys ' + JSON.stringify(Object.keys(nonce)) : typeof nonce;`,
-      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object of strings (or false), or undefined; got ' + got);`,
+      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object (each a string or false), or undefined; got ' + got);`,
       `}`,
     );
     if (noncePath) {

From e8001c92888d685e29ed8bec36a03b2377166848 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:09:11 -0300
Subject: [PATCH 06/13] fix: leave an empty handleRequest nonce to start.nonce

The runtime reads undefined, null and '' as no nonce. `handleRequest(request,
{ nonce: null })` (or '') skipped the module and sent the page without one;
now the module decides. `{ script: false, style: false }` still sends a
request without a nonce.
---
 .changeset/start-csp-nonce.md | 2 +-
 README.md                     | 5 +++--
 src/ssr/index.ts              | 7 +++++--
 virtual-solid-manifest.d.ts   | 3 ++-
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
index f4f7f95b..fda95bd0 100644
--- a/.changeset/start-csp-nonce.md
+++ b/.changeset/start-csp-nonce.md
@@ -4,4 +4,4 @@
 
 New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
 
-An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
+An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
diff --git a/README.md b/README.md
index 41758703..30bf2bb1 100644
--- a/README.md
+++ b/README.md
@@ -629,8 +629,9 @@ styles it injects. Inline scripts your own `Document` renders still need it
 spelled out (`nonce={getRequestEvent()?.locals.nonce}`). Authored entries
 receive the value as `context.nonce` in `render()`. Hosts driving the handler
 directly can pass `handleRequest(request, { nonce })`, which wins over the
-module. Server mode only: the client-mode shell is prerendered once at build
-time, so there is no request to take a nonce from.
+module unless it's empty (`undefined`, `null` or `''`). Server mode only: the
+client-mode shell is prerendered once at build time, so there is no request
+to take a nonce from.
 
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index d90e1131..7826f568 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -1337,7 +1337,9 @@ export function startServe(
     // CSP nonce (`start.nonce`): the `handleRequest` option wins, then the
     // configured module's per-request result. Both take @solidjs/web's
     // `CSPNonce` shape (a string for every destination, or a
-    // `{ script, style }` pair), and an empty result means no nonce.
+    // `{ script, style }` pair). An empty value (undefined, null or '')
+    // means none, as in the runtime, so an empty option leaves the nonce
+    // to the module.
     lines.push(
       ``,
       `function assertNonce(nonce, source) {`,
@@ -1366,7 +1368,8 @@ export function startServe(
         `    '((event) => CSPNonce | undefined | Promise<...>): ' + ${JSON.stringify(noncePath)});`,
         `}`,
         `async function resolveNonce(event, options) {`,
-        `  if (options.nonce !== undefined) return assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `  const nonce = assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `  if (nonce !== undefined) return nonce;`,
         `  return assertNonce(await nonceModule(event), 'the start.nonce module (' + ${JSON.stringify(noncePath)} + ') result');`,
         `}`,
       );
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index d6c81a51..c0a66b90 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -55,7 +55,8 @@ declare module "virtual:solid-ssr-handler" {
        * Per-call CSP nonce, overriding `start.nonce`, in `@solidjs/web`'s
        * `CSPNonce` shape. A string applies to scripts and styles; a
        * `{ script, style }` pair routes each destination, with `false`
-       * leaving it un-nonced. It reaches the generated entry's
+       * leaving it un-nonced. An empty value (`undefined`, `null` or `''`)
+       * leaves the nonce to `start.nonce`. It reaches the generated entry's
        * `renderToStream` (hydration, streamed data and swap scripts,
        * `modulepreload` links), the injected client-entry tag and the
        * post-flush redirect fallback; authored entries receive it as

From a64b7945f793276d70a796496349496a674cda9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:09:18 -0300
Subject: [PATCH 07/13] fix: let a host's context.nonce through when no nonce
 resolves

A resolved nonce still goes over options.context, so the render, the
client-entry tag and the redirect fallback agree. Without one, the spread
wrote `nonce: undefined` over a nonce the host passed in options.context;
it now reaches the entry as on next.
---
 .changeset/start-csp-nonce.md | 2 +-
 src/ssr/index.ts              | 8 +++++---
 virtual-solid-manifest.d.ts   | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
index fda95bd0..0d1a95a5 100644
--- a/.changeset/start-csp-nonce.md
+++ b/.changeset/start-csp-nonce.md
@@ -4,4 +4,4 @@
 
 New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
 
-An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
+An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module, and a `nonce` the host passes in `options.context` still reaches authored entries when no nonce resolves. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 7826f568..853bfdf6 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -1521,10 +1521,12 @@ export function startServe(
       `  const renderMode = await resolveRenderMode(event, options);`,
       // Same window for the nonce: after the chain, so a middleware that
       // generated it (and set the CSP header) has stored it on `locals`.
-      // It goes after `options.context` so the render can't get a different
-      // value from the one the client-entry tag and the redirect fallback get.
+      // A resolved nonce goes over `options.context`, so the render can't
+      // get a different value from the one the client-entry tag and the
+      // redirect fallback get. Without one, a `nonce` the host put in
+      // `options.context` reaches the entry as before.
       `  const nonce = ${noncePath ? 'await ' : ''}resolveNonce(event, options);`,
-      `  let result = entry.render(request, { clientEntry, ...options.context, nonce });`,
+      `  let result = entry.render(request, { clientEntry, ...options.context, ...(nonce === undefined ? {} : { nonce }) });`,
       // renderToStream results are thenables whose then() waits for the
       // *complete* render — check for pipe first so streaming survives, and
       // only await plain promises (async render functions).
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index c0a66b90..1b42fdf1 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -60,7 +60,8 @@ declare module "virtual:solid-ssr-handler" {
        * `renderToStream` (hydration, streamed data and swap scripts,
        * `modulepreload` links), the injected client-entry tag and the
        * post-flush redirect fallback; authored entries receive it as
-       * `context.nonce`.
+       * `context.nonce`, in place of a `nonce` passed in `context`, which
+       * reaches them unchanged when no nonce resolves.
        */
       nonce?: CSPNonce;
       /**

From 6661fdd0cbb51fe15718046f4213990657f4a85a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:09:18 -0300
Subject: [PATCH 08/13] docs: rewrap the start.nonce section and note the
 client-mode dev shell

---
 README.md        | 13 +++++++++----
 src/ssr/index.ts |  3 ++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 30bf2bb1..feff561d 100644
--- a/README.md
+++ b/README.md
@@ -588,8 +588,9 @@ with `script-src 'nonce-…'` and no `'unsafe-inline'`. A module path
 (relative to the Vite root, following the `middleware`/`setup`/`renderMode`
 convention) default-exporting `(event) => CSPNonce | undefined |
 Promise<...>`, where `CSPNonce` is `@solidjs/web`'s `string | { script,
-style }` (each a string, or `false` to leave that destination un-nonced). It runs inside the request scope after the middleware chain, so
-the middleware that generates the nonce and sets the header can hand it over
+style }` (each a string, or `false` to leave that destination un-nonced).
+It runs inside the request scope after the middleware chain, so the
+middleware that generates the nonce and sets the header can hand it over
 through `event.locals`:
 
 ```ts
@@ -602,7 +603,10 @@ solid({
 // src/middleware.ts
 import { getRequestEvent } from '@solidjs/web';
 
-export default async function csp(request: Request, next: (request?: Request) => Promise<Response>) {
+export default async function csp(
+  request: Request,
+  next: (request?: Request) => Promise<Response>,
+) {
   const nonce = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
   getRequestEvent()!.locals.nonce = nonce;
   const response = await next();
@@ -631,7 +635,8 @@ receive the value as `context.nonce` in `render()`. Hosts driving the handler
 directly can pass `handleRequest(request, { nonce })`, which wins over the
 module unless it's empty (`undefined`, `null` or `''`). Server mode only: the
 client-mode shell is prerendered once at build time, so there is no request
-to take a nonce from.
+to take a nonce from (the per-call option still reaches the shell the dev
+server renders).
 
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 853bfdf6..08ae8a77 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -285,7 +285,8 @@ export interface StartOptions {
    *
    * Hosts driving the handler directly can override it per call with
    * `handleRequest(request, { nonce })`. Server mode only: client mode
-   * ignores it, since its shell is prerendered once at build time.
+   * ignores it, since its shell is prerendered once at build time (the
+   * per-call override still reaches the shell the dev server renders).
    *
    * @default undefined
    */

From 9f100ad62997399b5522cc2a3c3e826ad9ad80da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:09:24 -0300
Subject: [PATCH 09/13] test: cover the start.nonce module, authored entries
 and the dev server

The nonce mode now checks the module's async and pair results, an invalid
result and a missing default export, the empty and false/false overrides,
incomplete pairs, a pair with distinct values in the dev head, the escaped
redirect fallback, authored entries both ways, and the real dev server on a
page with a lazy component's CSS.
---
 examples/start-ssr/src/middleware.ts |   5 +-
 examples/start-ssr/src/nonce.ts      |  17 +-
 examples/start-ssr/test/run.mjs      | 251 ++++++++++++++++++++++++++-
 3 files changed, 257 insertions(+), 16 deletions(-)

diff --git a/examples/start-ssr/src/middleware.ts b/examples/start-ssr/src/middleware.ts
index aa429b99..02642244 100644
--- a/examples/start-ssr/src/middleware.ts
+++ b/examples/start-ssr/src/middleware.ts
@@ -121,9 +121,12 @@ async function first(request: Request, next: Next): Promise<Response> {
   event.locals.order = ['first'];
   event.locals.user = 'mw-user';
   // `start.nonce` evidence (nonce mode): the nonce module reads what the
-  // chain stored, proving it runs after the middleware.
+  // chain stored, proving it runs after the middleware. `x-csp-nonce-json`
+  // stores any shape (a `{ script, style }` pair, an invalid value).
   const cspNonce = request.headers.get('x-csp-nonce');
   if (cspNonce) event.locals.nonce = cspNonce;
+  const cspNonceJson = request.headers.get('x-csp-nonce-json');
+  if (cspNonceJson) event.locals.nonce = JSON.parse(cspNonceJson);
   if (new URL(request.url).pathname === '/blocked') {
     // Early return: this Response never goes through createSSRResponse, so
     // the stub write below only reaches the wire through the handler
diff --git a/examples/start-ssr/src/nonce.ts b/examples/start-ssr/src/nonce.ts
index 170887d4..87eb2940 100644
--- a/examples/start-ssr/src/nonce.ts
+++ b/examples/start-ssr/src/nonce.ts
@@ -2,12 +2,15 @@
 // through `start.nonce` in vite.config.ts, next to SSR_MIDDLEWARE=1).
 // Server-only: only the generated handler imports it. The recipe from the
 // README: the middleware generates the nonce (here it takes the test's
-// `x-csp-nonce` header instead, to stay deterministic) and stores it on
-// `event.locals`; this module hands it to the handler, which runs it after
-// the chain.
-import type { RequestEvent } from '@solidjs/web';
+// `x-csp-nonce` / `x-csp-nonce-json` headers instead, to stay
+// deterministic) and stores it on `event.locals`; this module hands it to
+// the handler, which runs it after the chain and validates the result. The
+// `x-csp-nonce-async` header is the test's switch for the async form.
+import type { CSPNonce, RequestEvent } from '@solidjs/web';
 
-export default function nonce(event: RequestEvent): string | undefined {
-  const value = event.locals.nonce;
-  return typeof value === 'string' ? value : undefined;
+export default function nonce(
+  event: RequestEvent,
+): CSPNonce | undefined | Promise<CSPNonce | undefined> {
+  const value = event.locals.nonce as CSPNonce | undefined;
+  return event.request.headers.has('x-csp-nonce-async') ? Promise.resolve(value) : value;
 }
diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index c7b6980d..873497e6 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -5955,14 +5955,23 @@ async function runVitestMode() {
 //   swap scripts, the client entry, the dev head) and every modulepreload
 //   link carries it, escaped, and so does the post-flush redirect fallback;
 //   the `{ script, style }` form works (it used to throw building the entry
-//   tag) and an invalid value (a primitive, an array, a typo'd key) is
-//   rejected,
+//   tag) and an invalid value (a primitive, an array, a typo'd key, a pair
+//   missing a destination) is rejected; a resolved nonce wins over a
+//   `nonce` in `options.context`,
 // - dev head: the collected styles carry the style nonce and a `csp-nonce`
-//   meta hands it to the Vite client,
+//   meta hands it to the Vite client; a pair keeps the two destinations
+//   apart,
 // - `start.setup` renders with the nonce too (its own render path),
 // - the module form (src/nonce.ts) resolves the nonce after the middleware
-//   chain (it reads what src/middleware.ts stored on `event.locals`), and
-//   the runtime option still wins over it,
+//   chain (it reads what src/middleware.ts stored on `event.locals`), sync
+//   or async, string or pair; the runtime option still wins over it unless
+//   it's empty, an invalid result names the module, and a module without a
+//   default-exported function is rejected,
+// - the dev server, end to end: on a page with a lazy component's CSS,
+//   every <style> carries the style nonce and every <script> the script
+//   nonce,
+// - authored entries receive the resolved nonce as `context.nonce`, and a
+//   host's own `context.nonce` when nothing resolves,
 // - the built handler does the same through both `handleRequest` and the
 //   default Fetchable (the path hosts like Nitro dispatch through, which
 //   passes no options),
@@ -6076,14 +6085,14 @@ async function runNonceMode() {
     const redirect = await (
       await handler.handleRequest(
         new Request('http://localhost/redirect-post', { headers: { accept: 'text/html' } }),
-        { nonce: 'redirect-nonce' },
+        { nonce: 'redirect"<&' },
       )
     ).text();
     record(
       mode,
       'override',
-      'post-flush redirect fallback carries the nonce',
-      /<script nonce="redirect-nonce">[^<]*window\.location/.test(redirect),
+      'post-flush redirect fallback carries the nonce, escaped',
+      /<script nonce="redirect&quot;&lt;&amp;">[^<]*window\.location/.test(redirect),
     );
     const devStyle = '<style data-asset="probe.css">.probe{}</style>';
     const styled = await (
@@ -6108,10 +6117,31 @@ async function runNonceMode() {
       'style: false leaves the dev styles and the meta un-nonced',
       scriptOnly.includes('<style data-asset="probe.css">') && !scriptOnly.includes('csp-nonce'),
     );
+    // Distinct values, so a script/style swap anywhere in the dev head shows.
+    const pairHead = await (
+      await handler.handleRequest(page(), {
+        nonce: { script: 'pair-script', style: 'pair-style' },
+        devHead: devStyle,
+      })
+    ).text();
+    const pairCheck = everyTagCarries(pairHead, 'pair-script');
+    record(
+      mode,
+      'override',
+      'a { script, style } pair: scripts and preloads take script, dev styles and the meta take style',
+      pairCheck.ok &&
+        pairHead.includes('<style nonce="pair-style" data-asset="probe.css">') &&
+        pairHead.includes('<meta property="csp-nonce" nonce="pair-style">') &&
+        !/<script\b[^>]*nonce="pair-style"/.test(pairHead),
+      pairCheck.detail,
+    );
     for (const [value, label, expected] of [
       [42, 'a number', 'number'],
       [['a'], 'an array', 'an array'],
       [{ nonce: 'a' }, 'an object with a misspelled key', '["nonce"]'],
+      [{}, 'an empty object', 'keys []'],
+      [{ script: 'a' }, 'a pair without style', '["script"]'],
+      [{ script: 'a', style: 1 }, 'a pair with a number', '["script","style"]'],
     ]) {
       let rejection = '';
       try {
@@ -6174,6 +6204,73 @@ async function runNonceMode() {
       'module returning undefined leaves the document without a nonce',
       carriesNone(await (await handler.handleRequest(page())).text()),
     );
+    // An empty option (as the runtime reads it) leaves the nonce to the
+    // module; `{ script: false, style: false }` is the per-call way out.
+    for (const [value, label] of [
+      [null, 'null'],
+      ['', "''"],
+    ]) {
+      const deferred = await (
+        await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), { nonce: value })
+      ).text();
+      record(
+        mode,
+        'module',
+        `handleRequest({ nonce: ${label} }) leaves the nonce to the module`,
+        everyTagCarries(deferred, 'from-locals').ok,
+      );
+    }
+    record(
+      mode,
+      'module',
+      'handleRequest({ nonce: { script: false, style: false } }) sends the page without one',
+      carriesNone(
+        await (
+          await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), {
+            nonce: { script: false, style: false },
+          })
+        ).text(),
+      ),
+    );
+    const viaAsync = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'async-nonce', 'x-csp-nonce-async': '1' }))
+    ).text();
+    const asyncCheck = everyTagCarries(viaAsync, 'async-nonce');
+    record(mode, 'module', 'an async module result is awaited', asyncCheck.ok, asyncCheck.detail);
+    const modulePair = await (
+      await handler.handleRequest(
+        page({ 'x-csp-nonce-json': '{"script":"mod-script","style":"mod-style"}' }),
+        { devHead: '<style data-asset="probe.css">.probe{}</style>' },
+      )
+    ).text();
+    const modulePairCheck = everyTagCarries(modulePair, 'mod-script');
+    record(
+      mode,
+      'module',
+      'a { script, style } pair from the module routes each destination',
+      modulePairCheck.ok &&
+        modulePair.includes('<style nonce="mod-style" data-asset="probe.css">') &&
+        modulePair.includes('<meta property="csp-nonce" nonce="mod-style">') &&
+        !/<script\b[^>]*nonce="mod-style"/.test(modulePair),
+      modulePairCheck.detail,
+    );
+    // The nonce resolves inside the dispatch, so the throw unwinds through
+    // the chain and src/middleware.ts's error middleware turns it into its
+    // 500, with the message in the body.
+    const invalidResponse = await handler.handleRequest(
+      page({ 'x-csp-nonce-json': '{"script":"a"}' }),
+    );
+    const moduleRejection = await invalidResponse.text();
+    record(
+      mode,
+      'module',
+      'an invalid module result is rejected naming the module',
+      invalidResponse.status === 500 &&
+        moduleRejection.includes('the start.nonce module (') &&
+        moduleRejection.includes('src/nonce.ts') &&
+        moduleRejection.includes('["script"]'),
+      `status ${invalidResponse.status}: ${moduleRejection.slice(0, 200)}`,
+    );
     const transformed = await probe.environments.ssr.transformRequest('virtual:solid-ssr-handler');
     record(
       mode,
@@ -6205,6 +6302,144 @@ async function runNonceMode() {
     delete process.env.SSR_SETUP;
   }
 
+  // ---- A module without a default-exported function -----------------------
+  const invalidModule = 'src/nonce-invalid.ts';
+  writeFileSync(path.join(exampleDir, invalidModule), `export default 'not-a-function';\n`);
+  process.env.SSR_NONCE = './' + invalidModule;
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    let importError = '';
+    try {
+      await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    } catch (e) {
+      importError = String(e && e.message ? e.message : e);
+    }
+    record(
+      mode,
+      'module',
+      'a module without a default-exported function is rejected naming it',
+      importError.includes('start.nonce must default-export a function') &&
+        importError.includes('nonce-invalid.ts'),
+      importError.slice(0, 200) || 'imported without error',
+    );
+  } catch (e) {
+    record(mode, 'module', 'invalid-module probe completed', false, String(e));
+  } finally {
+    await probe?.close();
+    delete process.env.SSR_NONCE;
+    rmSync(path.join(exampleDir, invalidModule), { force: true });
+  }
+
+  // ---- Dev server: the real dev middleware, styles collected per page -------
+  // A pair with distinct values through the module, on the home page and on
+  // one that loads a lazy component with its own CSS (src/ExtraInput.css,
+  // which the dev server collects into the head with the rest). Anything
+  // else that renders a <style> or <script> would show up here too.
+  const devPort = 3184;
+  const devOrigin = `http://localhost:${devPort}`;
+  let server;
+  try {
+    server = startProcess('pnpm', ['exec', 'vite', '--port', String(devPort), '--strictPort'], {
+      cwd: exampleDir,
+      env: { ...process.env, SSR_DEVTOOLS: '0', ...moduleEnv },
+    });
+    await waitForHttp(devOrigin + '/src/api.ts', 30000);
+    for (const route of ['/', '/extra-input']) {
+      const res = await fetch(devOrigin + route, {
+        headers: {
+          accept: 'text/html',
+          'x-csp-nonce-json': '{"script":"dev-script","style":"dev-style"}',
+        },
+      });
+      const html = await res.text();
+      const styles = [
+        ...(html.match(/<style\b[^>]*>/g) || []),
+        ...(html.match(/<link\b[^>]*>/g) || []).filter((tag) =>
+          /\srel="stylesheet"|\sas="style"/.test(tag),
+        ),
+      ];
+      const scripts = html.match(/<script\b[^>]*>/g) || [];
+      const off = [
+        ...styles.filter((tag) => !tag.includes(' nonce="dev-style"')),
+        ...scripts.filter((tag) => !tag.includes(' nonce="dev-script"')),
+      ];
+      record(
+        mode,
+        'dev-server',
+        `${route}: every <style> takes the style nonce, every <script> the script nonce`,
+        res.status === 200 && styles.length >= 1 && scripts.length >= 3 && off.length === 0,
+        `status ${res.status}, ${styles.length} styles, ${scripts.length} scripts, off: ${off.join(' ').slice(0, 300)}`,
+      );
+    }
+  } catch (e) {
+    record(mode, 'dev-server', 'dev server dispatch completed', false, String(e));
+  } finally {
+    if (server) {
+      try {
+        process.kill(-server.pid, 'SIGTERM');
+      } catch {}
+    }
+  }
+
+  // ---- Authored entries: the nonce arrives as context.nonce -----------------
+  const authoredFixtures = {
+    ...ENTRY_FIXTURES,
+    'src/entry-server.tsx': `import { renderToStream } from '@solidjs/web';
+import manifest from 'virtual:solid-manifest';
+import TestShell from './TestShell';
+
+export function render(request, context) {
+  return renderToStream(() => <TestShell />, { manifest, nonce: context.nonce });
+}
+`,
+  };
+  for (const [file, source] of Object.entries(authoredFixtures)) {
+    writeFileSync(path.join(exampleDir, file), source);
+  }
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    // The bootstrap <HydrationScript /> renders comes from the runtime, so
+    // its nonce is the one the authored render passed to renderToStream.
+    const bootstrapNonce = (html) =>
+      html.match(/<script\b[^>]*\snonce="([^"]*)"[^>]*>window\._\$HY/)?.[1];
+    const resolved = await (
+      await handler.handleRequest(page(), {
+        nonce: 'authored-nonce',
+        context: { nonce: 'context-nonce' },
+      })
+    ).text();
+    record(
+      mode,
+      'authored',
+      'authored render receives the resolved nonce as context.nonce',
+      resolved.includes('<title>Authored Entries</title>') &&
+        bootstrapNonce(resolved) === 'authored-nonce',
+      `bootstrap nonce ${JSON.stringify(bootstrapNonce(resolved))}`,
+    );
+    const hostOnly = await (
+      await handler.handleRequest(page(), { context: { nonce: 'host-nonce' } })
+    ).text();
+    record(
+      mode,
+      'authored',
+      "a host's context.nonce reaches the authored render when no nonce resolves",
+      bootstrapNonce(hostOnly) === 'host-nonce',
+      `bootstrap nonce ${JSON.stringify(bootstrapNonce(hostOnly))}`,
+    );
+  } catch (e) {
+    record(mode, 'authored', 'authored-entry direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    for (const file of Object.keys(authoredFixtures)) {
+      rmSync(path.join(exampleDir, file), { force: true });
+    }
+  }
+
   // ---- Built handler --------------------------------------------------------
   try {
     console.log('  building (nonce module)…');

From 920c5eeb4853f861e932cbc673b6ce16397f8ec5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:09:24 -0300
Subject: [PATCH 10/13] test: check the nonce reaches the client-mode dev shell

---
 examples/start-client/test/run.mjs | 34 ++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/examples/start-client/test/run.mjs b/examples/start-client/test/run.mjs
index 33b3fc3c..709ab67a 100644
--- a/examples/start-client/test/run.mjs
+++ b/examples/start-client/test/run.mjs
@@ -35,6 +35,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import path from 'node:path';
 import os from 'node:os';
 import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createServer } from 'vite';
 
 const exampleDir = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const CHROME =
@@ -325,6 +326,39 @@ async function devMode() {
   );
   record('dev', 'entry', 'toolbar wraps the generated app', entry.includes('DevToolbar'));
 
+  // `start.nonce` is server-mode only (the built shell is prerendered, with
+  // no request to take a nonce from), but the dev server renders the shell
+  // per request, so a host's `handleRequest(request, { nonce })` reaches
+  // it: the injected client entry, the style patch and the Vite client.
+  {
+    const nodeEnv = process.env.NODE_ENV;
+    const probe = await createServer({ root: exampleDir, server: { middlewareMode: true } });
+    try {
+      const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+      const shell = await (
+        await handler.handleRequest(
+          new Request('http://localhost/', { headers: { accept: 'text/html' } }),
+          { nonce: 'client-nonce' },
+        )
+      ).text();
+      const scripts = shell.match(/<script\b[^>]*>/g) || [];
+      record(
+        'dev',
+        'shell',
+        'handleRequest({ nonce }) reaches every script of the dev shell',
+        scripts.length >= 3 &&
+          scripts.every((tag) => tag.includes(' nonce="client-nonce"')) &&
+          !shell.includes('_$HY'),
+        scripts.join(' '),
+      );
+    } finally {
+      await probe.close();
+      // createServer sets NODE_ENV; the builds later in this run inherit it.
+      if (nodeEnv === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = nodeEnv;
+    }
+  }
+
   await runBrowserChecks('dev', origin);
 
   try {

From 837ad11340e5a12c7711b4b2938b896c4b9d4740 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:33:58 -0300
Subject: [PATCH 11/13] fix: reject an empty destination in a { script, style }
 nonce

The runtime drops an empty string, so `{ script: '', style: 'x' }` sent the
scripts without a nonce, and `{ script: '', style: '' }` switched the module
off while a bare '' defers to it.
---
 .changeset/start-csp-nonce.md | 2 +-
 src/ssr/index.ts              | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
index 0d1a95a5..563a74f4 100644
--- a/.changeset/start-csp-nonce.md
+++ b/.changeset/start-csp-nonce.md
@@ -4,4 +4,4 @@
 
 New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
 
-An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module, and a `nonce` the host passes in `options.context` still reaches authored entries when no nonce resolves. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a string or `false`) is rejected with an error naming its source.
+An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module, and a `nonce` the host passes in `options.context` still reaches authored entries when no nonce resolves. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a non-empty string or `false`) is rejected with an error naming its source.
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 08ae8a77..fbbb3384 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -1346,10 +1346,10 @@ export function startServe(
       `function assertNonce(nonce, source) {`,
       `  if (nonce == null || typeof nonce === 'string') return nonce || undefined;`,
       // A plain object with both destinations and nothing else, as the
-      // `CSPNonce` type has it: a missing or typo'd key or an array would
-      // otherwise leave a destination without a nonce without a word.
+      // `CSPNonce` type has it: a missing, empty or typo'd key or an array
+      // would otherwise leave a destination without a nonce without a word.
       `  const prototype = typeof nonce === 'object' ? Object.getPrototypeOf(nonce) : undefined;`,
-      `  const destination = (value) => value === false || typeof value === 'string';`,
+      `  const destination = (value) => value === false || (typeof value === 'string' && value !== '');`,
       `  if (`,
       `    (prototype === Object.prototype || prototype === null) &&`,
       `    Object.keys(nonce).every((key) => key === 'script' || key === 'style') &&`,
@@ -1359,7 +1359,7 @@ export function startServe(
       `    return nonce;`,
       `  }`,
       `  const got = Array.isArray(nonce) ? 'an array' : prototype ? 'an object with keys ' + JSON.stringify(Object.keys(nonce)) : typeof nonce;`,
-      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object (each a string or false), or undefined; got ' + got);`,
+      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object (each a non-empty string or false), or undefined; got ' + got);`,
       `}`,
     );
     if (noncePath) {

From da4045488fb959e05fece0c56c234f150759895d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:33:58 -0300
Subject: [PATCH 12/13] docs: type the nonce option as nullable and note the
 context passthrough

null already defers to start.nonce at runtime; the type now says so. The
README mentions that a host's own context.nonce is left alone when none
resolves, and the d.ts says it reaches generated entries too.
---
 README.md                   | 13 +++++++------
 virtual-solid-manifest.d.ts |  6 +++---
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index feff561d..b44fc4c2 100644
--- a/README.md
+++ b/README.md
@@ -631,12 +631,13 @@ scripts (with `'strict-dynamic'`, the modules they load are trusted in turn),
 the collected styles, and a `csp-nonce` meta the Vite client reads for the
 styles it injects. Inline scripts your own `Document` renders still need it
 spelled out (`nonce={getRequestEvent()?.locals.nonce}`). Authored entries
-receive the value as `context.nonce` in `render()`. Hosts driving the handler
-directly can pass `handleRequest(request, { nonce })`, which wins over the
-module unless it's empty (`undefined`, `null` or `''`). Server mode only: the
-client-mode shell is prerendered once at build time, so there is no request
-to take a nonce from (the per-call option still reaches the shell the dev
-server renders).
+receive the value as `context.nonce` in `render()` (a `nonce` passed in
+`handleRequest`'s `context` is left alone when none resolves). Hosts driving
+the handler directly can pass `handleRequest(request, { nonce })`, which wins
+over the module unless it's empty (`undefined`, `null` or `''`). Server mode
+only: the client-mode shell is prerendered once at build time, so there is no
+request to take a nonce from (the per-call option still reaches the shell the
+dev server renders).
 
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index 1b42fdf1..cfbad18b 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -59,11 +59,11 @@ declare module "virtual:solid-ssr-handler" {
        * leaves the nonce to `start.nonce`. It reaches the generated entry's
        * `renderToStream` (hydration, streamed data and swap scripts,
        * `modulepreload` links), the injected client-entry tag and the
-       * post-flush redirect fallback; authored entries receive it as
+       * post-flush redirect fallback; the entry's `render` receives it as
        * `context.nonce`, in place of a `nonce` passed in `context`, which
-       * reaches them unchanged when no nonce resolves.
+       * reaches the entry unchanged when no nonce resolves.
        */
-      nonce?: CSPNonce;
+      nonce?: CSPNonce | null;
       /**
        * Per-call render mode, overriding `start.renderMode` (static value or
        * per-request module alike). `'stream'` flushes the document shell

From ae2b5a8f9cea6cd725ad7864e046173d9ca1c981 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sat, 3 Oct 2026 03:33:58 -0300
Subject: [PATCH 13/13] test: check a module's false/false pair and the lazy
 page's stylesheet

---
 examples/start-ssr/test/run.mjs | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index 873497e6..852345b3 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -6142,6 +6142,7 @@ async function runNonceMode() {
       [{}, 'an empty object', 'keys []'],
       [{ script: 'a' }, 'a pair without style', '["script"]'],
       [{ script: 'a', style: 1 }, 'a pair with a number', '["script","style"]'],
+      [{ script: '', style: 'a' }, 'a pair with an empty script', '["script","style"]'],
     ]) {
       let rejection = '';
       try {
@@ -6232,6 +6233,18 @@ async function runNonceMode() {
         ).text(),
       ),
     );
+    record(
+      mode,
+      'module',
+      'a module returning { script: false, style: false } sends the page without one',
+      carriesNone(
+        await (
+          await handler.handleRequest(
+            page({ 'x-csp-nonce-json': '{"script":false,"style":false}' }),
+          )
+        ).text(),
+      ),
+    );
     const viaAsync = await (
       await handler.handleRequest(page({ 'x-csp-nonce': 'async-nonce', 'x-csp-nonce-async': '1' }))
     ).text();
@@ -6346,7 +6359,14 @@ async function runNonceMode() {
       env: { ...process.env, SSR_DEVTOOLS: '0', ...moduleEnv },
     });
     await waitForHttp(devOrigin + '/src/api.ts', 30000);
-    for (const route of ['/', '/extra-input']) {
+    // The lazy page must render its content and its own stylesheet, or the
+    // check would pass on App.css alone.
+    const pageChecks = {
+      '/': () => true,
+      '/extra-input': (html, styles) =>
+        html.includes('EXTRA-INPUT-PAGE') && styles.some((tag) => tag.includes('ExtraInput.css')),
+    };
+    for (const [route, pageCheck] of Object.entries(pageChecks)) {
       const res = await fetch(devOrigin + route, {
         headers: {
           accept: 'text/html',
@@ -6369,7 +6389,11 @@ async function runNonceMode() {
         mode,
         'dev-server',
         `${route}: every <style> takes the style nonce, every <script> the script nonce`,
-        res.status === 200 && styles.length >= 1 && scripts.length >= 3 && off.length === 0,
+        res.status === 200 &&
+          pageCheck(html, styles) &&
+          styles.length >= 1 &&
+          scripts.length >= 3 &&
+          off.length === 0,
         `status ${res.status}, ${styles.length} styles, ${scripts.length} scripts, off: ${off.join(' ').slice(0, 300)}`,
       );
     }