Considered using nullish coalescing operator (??) but decided against. If I understand properly this line doesn't go through any sort of transpiler so there might be browser compatibility issues?

Also tried nested string interpolation but wasn't able to get it to work.

Open to any suggestions here.

Encounter the following using JSON.stringify when siweNonce is null (when we navigate to the page directly in desktop browser):

Similarly we can't define const siweNonceString = siweNonce ?? "null";

I think what we'd need to do is

const siweNonceString = `"${siweNonce}"` ?? "null";

Where if siweNonce is null then the string gets computed as "" (empty string) which is falsey so we end up with "null" which ends up as null once in the html` string. (The way I thought about it is when we include siweNonceString in html` string the outer quote effectively gets "dropped")

I think what we'd need to do is

Disregard everything past this... it's incorrect.

What we'd really have is "" (two double quotes) NOT an empty string.

More verbose but I think the cleanest option here is:

const siweNonceString = siweNonce ? `"${siweNonce}"` : "null";

I don't think there's a way to do this with nullish coalescing even "from the outside"

More verbose but I think the cleanest option here is:

const siweNonceString = siweNonce ? `"${siweNonce}"` : "null";

I don't think there's a way to do this with nullish coalescing even "from the outside"

Yeah this is correct.

Elements tab:

Console tab:

This seems dangerous... you're letting somebody inject JavaScript into the site with a header. Eg. what if `siweNonce was set to something like:

const siweNonce = '" : null; do something bad code; const otherVar = true ? "';

Can you create a task to address?

I'm not fully understanding the scenario where code can be injected

I believe the double quotes around ${siweNonce} ensure that siweNonceString is a "quoted data value."

Reminder:

Can you create a task to address?

https://phab.comm.dev/D6022