Magento 2 Experten — Hyvä Theme, Tailwind CSS & SEO aus einer Hand ›

Correctly Registering and Testing the CSP-Compliant Inline Script

Correctly Registering and Testing the CSP-Compliant Inline Script

~7 Min. Lesezeit Zuletzt aktualisiert am August 9, 2026

The team page is functionally complete - just one crucial step from chapter 9 is missing: the inline <script> from chapter 21 needs to be registered via $hyvaCsp->registerInlineScript(), or the parent theme's strict CSP will block it silently in the browser.

Adding the registration

Right after the </script> tag from chapter 21, we add the registration - $hyvaCsp is available as a standard variable in every Hyvä template, just like $escaper:

app/code/Mironsoft/TeamPage/view/frontend/templates/team/index.phtml (excerpt)
<script>
    document.addEventListener('alpine:init', () => {
        Alpine.data('teamFilter', (members) => ({
            /* ... as in chapter 21 ... */
        }));
    });
</script>
<?php $hyvaCsp->registerInlineScript(); ?>

The complete template at a glance

Put together, team/index.phtml now consists of four parts, in this order:

  1. PHP header with @var annotations and access to the ViewModel + JSON serializer (chapters 19-21).
  2. HTML structure: heading, category buttons, Alpine x-for grid (chapters 20-21).
  3. Inline <script> with the Alpine.data('teamFilter', ...) component (chapter 21).
  4. $hyvaCsp->registerInlineScript(); directly after it (this chapter).

Testing: without and with registration

To really see the effect of the registration, it's worth doing a deliberate test: if you remove the line $hyvaCsp->registerInlineScript(); temporarily and reload the page, the filter function disappears - the category buttons stop reacting to clicks, even though nothing in the template looks broken.

Achtung: The failure does not show up as a PHP or Magento error - it only appears in the browser console (F12 > Console) as a CSP violation message, something like "Refused to execute inline script because it violates the following Content Security Policy directive...". That makes this failure especially tricky if you don't know where to look - chapter 28 addresses this specifically again.

Testing the full flow once more

bin/cache-clean
# Browser: visit /team
# 1. Grid shows all four team members
# 2. Click "Development" -> only Anna and David visible
# 3. Click "All" -> all four visible again
# 4. Dev tools Network tab: no request on click
# 5. Dev tools Console: no CSP violation message

The continuous project, complete

With that, the team page is complete: its own module, route, and controller, a ViewModel with cleanly separated data, a responsive Tailwind template, client-side Alpine filtering, and a correctly registered, CSP-compliant inline script. Block 6 now applies this knowledge to existing Magento default pages - the product detail page, checkout, and performance.

Tipp: These six chapters (17-22) can be reused as a template for any other own storefront page in this project: new module, route, controller, ViewModel, Tailwind template, Alpine interactivity with CSP registration if needed - always in exactly this order.