How to use jinja2 server side rendering alongside react without violating inline-script CSP

anthony-dandrea

I am new to React and experimenting a bit. I would like to use it on my Flask site that uses Jinja2 templates.

People seem to recommend to render data on the server-side first instead of having to always make an initial call for data on page load. I found this nodejs example but it just puts the data on the page in a global variable in an inline script tag. I was wondering if there was a clean way to do this other than just putting the data on the page inside an inline script tag. Because of my secure CSP policy I can't use inline scripts or eval.

Is there an standard pattern people use to render data for React on the server without using an inline variable?

siegerts

You can certainly use it on sites that have server side rendering via Jinja. The question becomes - what do you want to update on the page without reloading? Usually, the component state in React is updated via user interaction or a changing data source (i.e. db API).

My experience has been to render (via Jinja) the static page data and then use React components to update based on and/or listen for changes to the state of an API (maybe through Flask-Restful). These APIs can be accessed through React's life cycle methods (usually 'getInitialState' or 'setState')

For example - you may have portions of your site that are rendered server-side in layout.html and then the {% block content %} is rendered client side by the React js components.

{% extends "layout.html" %}


{% block content %}

<h2>Some Header</h2>

<script type="text/jsx" src="/scripts/ReactComponent1.js">
</script>

<div id="one">
<!-- This element's contents will be replaced with ReactComponent1. -   ->
</div>

<script type="text/jsx" src="/scripts/ReactComponent2.js">
</script>

<div id="two">
<!-- This element's contents will be replaced with ReactComponent2. -->
</div>



{% endblock %}

I really recommend going through the React Tutorial and trying to apply it to a Flask App.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Use CSP nonce without server side rendering (cookie)

How to use Angular 2 server side rendering

Why use React server side rendering

How to allow this code within a Chrome Packaged App without violating CSP?

React: How to use inline styles in conditional rendering?

How to export Component for server side rendering in React

Express server with React front end routing without server side rendering

How to use components that use `window` reference in React with server-side rendering?

React CRA with CSP: Refused to execute inline script

React server-side rendering without polling for changes

How to add additional express routes in react server side rendering to use as backend

How can I use style-loader in react SSR (Server Side Rendering)?

How to let script to use setAttribute 'style' without breaking CSP

Need advice converting React app to use server side rendering

Does React use server-side-rendering or client-side-rendering?

React Server Side Rendering - addEventListener

React - server side component rendering

react server side rendering with client side routing

Server-side rendering + responsive design + inline styles -> which breakpoint to use?

React Server Side Rendering App - how to update meta data

How to do server-side rendering in React/redux?

How setup react-helmet with Server Side Rendering?

How to run Dockerized React application in SSR (Server Side Rendering) mode

React / Express - How will server side rendering work with my dynamic pages

Server Side Rendering For Angular 2

How to use multiple contexts for single DB, without violating dependency injection

How to use a std::lock_guard without violating const correctness?

React js server side rendering and host in IIS

React server side rendering ReferenceError: document is not defined