10

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript?

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

See example 4 here for details.

2

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

Yes. You always have to disable caching on anything that is dynamically generated (i.e. comes from a script). Since you can't serve unique and unpredictable random values statically, it must be done from a script.

  • Thanks. That's the conclusion I came to as well, which makes this method impractical IMHO for all but the smallest sites. – user2687991 Dec 4 '16 at 7:51
  • @user2687991 Site size has little to do with it. If you have the money, you can always add more servers to handle the load. – DepressedDaniel Dec 4 '16 at 19:53
  • 2
    Couldn't you use or create a Varnish module that replaces a placeholder string with a nonce in every response? – darkangel Apr 24 '17 at 20:59
  • @darkangel what keeps the attacker from including the placeholder? I don't think this is trivial to solve. – Prinzhorn Jul 12 '17 at 16:55
  • @Prinzhorn How would the attacker know what the placeholder string is? It could be absolutely anything, and could be updated frequently. – darkangel Aug 27 '17 at 13:03
2

This can be happily cached by the application server for days without negatively impacting the CSP nonce protection.

No. The nonce should be unique for every request (nonce = number used once).

I guess the only solution is to use non-cached SSI (server side includes) for the script-tags containing the nonce and combinating that with the nonce in the response content security header or another little SSI for the meta http-equiv="Content-Security-Policy"-tag.

This will make every page unique and thus not cacheable.

0

It depends which server-side cache we're talking about as this has usually many layers. If your application server is caching HTML to save on expensive SQL queries and template processing, then you still can use nonces by modifying the output HTML on the way back. Your templates and the cached HTML may contain placeholders like this:

<script nonce="REPLACE_WITH_NONCE">
...
</script>

This can be happily cached by the application server for days without negatively impacting the CSP nonce protection.

The nonce may be then generated dynamically on the web server using OpenResty set_secure_random_alphanum and substituted into the REPLACE_WITH_NONCE placeholder with ngx_http_sub_module

  • Now the attacker can simply include REPLACE_WITH_NONCE as part of the exploit, right? The malicious script now gets the valid nonce as well. – Prinzhorn Jul 12 '17 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.