Interface InjectScriptOptions

The tag's async flag, true unless given false. A script-created tag is async by default and runs as soon as it arrives; with false it runs in insertion order among the scripts injected that way.

Further attributes for the tag, set with setAttribute, such as the configuration an SDK reads from its own <script>. A name the helper manages (src, async, defer, integrity, crossorigin, nonce, type, and nomodule, language, event and for, which can make the browser skip the script without a load or error event, leaving the call pending) or one that runs script (any name starting with on), compared case-insensitively, rejects with a non-retryable invalid_request, as does a name setAttribute refuses; either way nothing is injected.

The tag's crossorigin attribute. Defaults to "anonymous" when integrity is set: the browser checks a cross-origin file only when it is fetched in CORS mode, which its server must allow, and blocks one it cannot check. "use-credentials" fails against a CDN answering Access-Control-Allow-Origin: *. Without integrity it is set only when given. With integrity, a tag already on the page must have the attribute to be reused; its value is not compared.

Subresource Integrity metadata, set verbatim as the tag's integrity attribute, e.g. "sha384-<base64 digest>". The browser refuses to run a file that does not match, and that refusal rejects like any other load failure. A value holding no well-formed sha256, sha384 or sha512 token — lowercase algorithm name, base64 digest — rejects with a non-retryable invalid_request, and nothing is injected: empty values, mistyped or uppercase algorithm names and malformed digests are all skipped by Chromium and Firefox, which would then run the file unchecked.

With it, the call also detects a conflicting <script> already on the page for the same URL (see injectScript). That is not a trust boundary: every shipped client adapter returns from loadSdk() before calling injectScript once the SDK global exists, so a copy the host page already loaded is used without any check.

A Content-Security-Policy nonce, set as the tag's nonce attribute. The browser reads it once, when it prepares the inserted script, and ignores a nonce set later; a policy whose script-src lists 'nonce-<value>' then allows the tag. That matters under a policy allowing scripts by nonce without 'strict-dynamic': 'strict-dynamic' allows a script-created tag without one, and a host source in script-src allows it anyway. A value isValidCspNonce refuses rejects with a non-retryable invalid_request, and nothing is injected.