Correctly Registering and Testing the CSP-Compliant Inline Script
Correctly Registering and Testing the CSP-Compliant Inline Script
~7 Min. Lesezeit Zuletzt aktualisiert am August 9, 2026
The team page is functionally complete - just one crucial step from chapter 9 is missing: the inline <script> from chapter 21 needs to be registered via $hyvaCsp->registerInlineScript(), or the parent theme's strict CSP will block it silently in the browser.
Adding the registration
Right after the </script> tag from chapter 21, we add the registration - $hyvaCsp is available as a standard variable in every Hyvä template, just like $escaper:
<script>
document.addEventListener('alpine:init', () => {
Alpine.data('teamFilter', (members) => ({
/* ... as in chapter 21 ... */
}));
});
</script>
<?php $hyvaCsp->registerInlineScript(); ?>The complete template at a glance
Put together, team/index.phtml now consists of four parts, in this order:
- PHP header with
@varannotations and access to the ViewModel + JSON serializer (chapters 19-21). - HTML structure: heading, category buttons, Alpine
x-forgrid (chapters 20-21). - Inline
<script>with theAlpine.data('teamFilter', ...)component (chapter 21). $hyvaCsp->registerInlineScript();directly after it (this chapter).
Testing: without and with registration
To really see the effect of the registration, it's worth doing a deliberate test: if you remove the line $hyvaCsp->registerInlineScript(); temporarily and reload the page, the filter function disappears - the category buttons stop reacting to clicks, even though nothing in the template looks broken.
Achtung: The failure does not show up as a PHP or Magento error - it only appears in the browser console (F12 > Console) as a CSP violation message, something like "Refused to execute inline script because it violates the following Content Security Policy directive...". That makes this failure especially tricky if you don't know where to look - chapter 28 addresses this specifically again.
Testing the full flow once more
bin/cache-clean
# Browser: visit /team
# 1. Grid shows all four team members
# 2. Click "Development" -> only Anna and David visible
# 3. Click "All" -> all four visible again
# 4. Dev tools Network tab: no request on click
# 5. Dev tools Console: no CSP violation messageThe continuous project, complete
With that, the team page is complete: its own module, route, and controller, a ViewModel with cleanly separated data, a responsive Tailwind template, client-side Alpine filtering, and a correctly registered, CSP-compliant inline script. Block 6 now applies this knowledge to existing Magento default pages - the product detail page, checkout, and performance.
Tipp: These six chapters (17-22) can be reused as a template for any other own storefront page in this project: new module, route, controller, ViewModel, Tailwind template, Alpine interactivity with CSP registration if needed - always in exactly this order.