Bug: Auto-inserted `rel=preload` script resources are blocked by nonce-CSP about react

[gnoff]

@ingmarh thanks for reporting. yes we should be using the nonce on the preload if it was present on the underlying script.

@liuyenwei if you want to take a pass at putting together a PR that's be great. I'll review. If you don't think you will be able to provide one this week I'll take care of it soon. let me know if you intend to (no pressure either way)

[gaearon]

cc @gnoff

[liuyenwei]

I was testing 18.3.0-canary-a389046a5-20230512 and also ran into this same issue.

Just to add onto the use case in the initial post - this also happens for preload links which are generated for React.lazy components.

I'm happy to take a pass at pushing up a PR for this if there is no disagreement that this should be the expected behavior.

[liuyenwei]

@gnoff sounds good - I can work on that this week 👍

[liuyenwei]

@ingmarh @gnoff #26826

[gaearon]

Closing per #26826 (review).

[ingmarh]

I can confirm that the issue is fixed with the latest canary, 18.3.0-canary-535c038d1-20230522.
Thank you for the fix, @liuyenwei.

@gnoff Thanks for your additional comment #26826 (review). It makes a lot of sense to me.