Breaks sitemap.xml when JS +CSS + Noscript protection is enabled

Created on 17 June 2021, almost 4 years ago
Updated 7 February 2023, over 2 years ago

Problem/Motivation

When "Enable JavaScript + CSS + Noscript protection" is checked and there is a sitemap.xml which produced by xmlsitemap then I get white page on http://domain.tld/sitemap.xml.
When it is disabled, I get the correct sitemap.xml.

Steps to reproduce

* Install xmlsitemap module and seckit as well
* Generate sitemap.xml
* Enable "Enable JavaScript + CSS + Noscript protection"

Proposed resolution

Do not break sitemap.xml.

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇭🇺Hungary asrob Hungary 🇭🇺 🇪🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇪🇸Spain stf54

    Bug confirmed.

    #2 works for me.

    drupal/core: 9.4.8
    drupal/seckit: 2.0.0
    drupal/simple_sitemap: 4.1.1

  • 🇭🇺Hungary fox mulder

    #2 works great

    drupal core: 10.2.3
    seckit: 2.0.1
    xmlsitemap: 8.x-1.5

  • Status changed to Needs review over 1 year ago
  • Open in Jenkins → Open on Drupal.org →
    Core: 10.2.1 + Environment: PHP 8.2 & MySQL 8
    last update over 1 year ago
    Patch Failed to Apply
  • 🇬🇧United Kingdom the_g_bomb

    The patch submitted in: https://www.drupal.org/project/seckit/issues/3193443#comment-15429382 📌 Avoid using document.write(' Needs review reports to fix a similar issue by setting the defer attribute as defer="defer" instead of just 'defer' for the seckit.frame_check.js file.

    Is it worth checking if that has a positive effect here too? Perhaps if this is the correct approach the patch at the other ticket should fix the issue this way too.

  • 🇪🇸Spain bmunslow

    Patch in #2 works fine but we found issues in prod site were this file is cached by the browser. Please find attached a minor improvement patch, whcih adds an empty get query to avoid browser caching.

  • 🇮🇳India arjak-mondal

    The JS file is executing for the DOM is loaded. This is fix version of that patch.

  • 🇮🇳India rahulrasgon

    The previous patch https://www.drupal.org/project/seckit/issues/3219252#comment-16099306 🐛 Breaks sitemap.xml when JS +CSS + Noscript protection is enabled Active appends a ? to the JavaScript file URL to bypass browser caching. While this approach works in many cases, it is not ideal because alone query string (?) may still result in caching under some proxy or CDN configurations, and it doesn't provide clear cache invalidation when the file changes.

    This updated patch improves on that by appending the module version as a query string parameter (?v=MODULE_VERSION). This ensures that the browser and any intermediate caches will fetch a new version of the file when the module is updated, while still allowing caching between deployments. It's a more robust and semantically correct way to bust the cache when needed, without completely disabling it.

Production build 0.71.5 2024