---
name: "up.script.config"
area: "API"
kind: "Configuration object"
parent: "up.script module"
url: "https://unpoly.com/api/up.script.config"
---
<nav aria-label="Unpoly docs">[All docs](https://unpoly.com/index.md) · [up.script module](https://unpoly.com/api/up.script.md)</nav>

# up.script.config

Configures defaults for script handling and asset tracking.

---

## Value {#value}

### Assets {#value-assets}

#### [config.assetSelectors] {#config.assetSelectors}

(optional)

An array of CSS selectors matching default [assets](https://unpoly.com/api/up-asset.md).

By default, all remote scripts and stylesheets in the `<head>` are considered assets. [Inline scripts](https://simpledev.io/lesson/inline-script-javascript-1/) and [internal styles](https://www.tutorialspoint.com/How-to-use-internal-CSS-Style-Sheet-in-HTML) are not tracked by default, but you can include them with an [`[up-asset]`](https://unpoly.com/api/up-asset.md) attribute.

Unpoly only tracks assets in the `<head>`. Elements in the `<body>` are never tracked, even if they match one of the configured selectors.

See [Tracking assets](https://unpoly.com/learn/handling-asset-changes.md#tracking-assets) for examples.

Type: [Array](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array)<string>

#### [config.noAssetSelectors] {#config.noAssetSelectors}

(optional)

Exceptions to `up.script.config.assetSelectors`.

Matching elements will _not_ be considered [assets](https://unpoly.com/api/up-asset.md), even if they match `up.script.config.assetSelectors`.

Type: [Array](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array)<string>

### Scripts {#value-scripts}

#### [config.scriptSelectors] {#config.scriptSelectors}

(optional)

An array of CSS selectors matching elements that run JavaScript.

By default, this matches all `<script>` elements with a JavaScript type.

This configuration does not affect what Unpoly considers [assets](https://unpoly.com/api/up-asset.md). For this, configure `up.script.config.assetSelectors`.

Type: [Array](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array)<string>

#### [config.noScriptSelectors] {#config.noScriptSelectors}

(optional)

Exceptions to `up.script.config.scriptSelectors`.

Type: [Array](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array)<string>

#### [config.evalCallbackPolicy='auto'] {#config.evalCallbackPolicy}

(optional)

Whether Unpoly will [run callbacks in HTML attributes](https://unpoly.com/learn/script-security.md#attribute-callbacks) like [`[up-on-loaded]`](https://unpoly.com/api/up-follow.md#up-on-loaded).

Type: string

#### [config.scriptElementPolicy='auto'] {#config.scriptElementPolicy}

(optional)

Whether Unpoly will [run `<script>` elements in new fragments](https://unpoly.com/learn/script-security.md#script-elements).

Type: string

#### [config.cspNonce] {#config.cspNonce}

(optional)

A [CSP script nonce](https://content-security-policy.com/nonce/) for the initial page that [booted](https://unpoly.com/api/up.boot.md) Unpoly.

The nonce lets Unpoly run JavaScript in HTML attributes like [`[up-on-loaded]`](https://unpoly.com/api/up-follow.md#up-on-loaded) or [`[up-on-accepted]`](https://unpoly.com/api/up-layer-new.md#up-on-accepted). See [Restricting callbacks with nonces](https://unpoly.com/learn/script-security.md#callback-nonces).

The nonce can either be configured as a string or as a function that returns the nonce.

Defaults to the `content` attribute of a `<meta>` tag named `csp-nonce`:

```
<meta name='csp-nonce' content='secret4367243'>
```

Type: string | Function(): string

#### [config.cspWarnings=true] {#config.cspWarnings}

(optional)

Whether Unpoly will print a warning when it observes a potentially unsafe `Content-Security-Policy` header.

Type: boolean