From 529f5af5f686c98efe6c045d5b1a63349155cac9 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Sat, 6 Dec 2025 10:08:22 -0800
Subject: [PATCH] CSP adherence: fix magic links console logging (#1989)

* CSP: fix magic link console logging by including nonce in the script tag

* Remove unused back-nav controller

Unused since c0f842427df16114c4e2d9cc109c5820ab99cf73

Eliminates a potential CSP violation with javascript: URI
---
 .../controllers/back_navigation_controller.js       | 13 -------------
 app/views/sessions/magic_links/show.html.erb        |  4 ++--
 2 files changed, 2 insertions(+), 15 deletions(-)
 delete mode 100644 app/javascript/controllers/back_navigation_controller.js

diff --git a/app/javascript/controllers/back_navigation_controller.js b/app/javascript/controllers/back_navigation_controller.js
deleted file mode 100644
index 8fad83419..000000000
--- a/app/javascript/controllers/back_navigation_controller.js
+++ /dev/null
@@ -1,13 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-export default class extends Controller {
-  static values = { fallbackDestination: String }
-
-  connect() {
-    if (history.state.turbo?.restorationIndex > 0) {
-      this.element.href = "javascript:history.back()"
-    } else {
-      this.element.href = this.fallbackDestinationValue
-    }
-  }
-}
diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index 434bb93c3..7eca24264 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -17,9 +17,9 @@
 </div>
 
 <% if Rails.env.development? %>
-  <script>
+  <%= javascript_tag do %>
     console.log("Magic link code: <%= flash[:magic_link_code].presence || "not generated" %>");
-  </script>
+  <% end %>
 <% end %>
 
 <% content_for :footer do %>