I've been attempting to incorporate a nonce into the csp policy but it's not functioning as anticipated.
Here's the code snippet I'm currently using for testing purposes:
server.js
express.use(function(req, res, next) {
res.set({
"Content-Security-Policy":"script-src 'self' 'nonce-random1'"
});
return next();
});
index.html
<script nonce="random1" type="text/javascript" src="/script1.js">
</script>
When checking the browser console, I encountered this error message: Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-random1'...
As an experiment, I attempted to add the source /script1.js as if it were a domain:
express.use(function(req, res, next) {
res.set({
"Content-Security-Policy":"script-src 'self' /script1.js"
});
return next();
});
Despite my efforts, the solution didn't work and I still received the same error message.
I checked the documentation and confirmed that the syntax was correct. I also searched for relevant questions or articles but couldn't find any useful information.
I prefer not to use unsafe-inline. Instead, I plan to implement a one-time hash as a nonce for each request in the future.
Does anyone have insight into why the nonce is not functioning as expected?