HTTP Content-Security-Policy Nonce and Caching

Question

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript?

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

See example 4 here for details.

Answer 1

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

Yes. You always have to disable caching on anything that is dynamically generated (i.e. comes from a script). Since you can't serve unique and unpredictable random values statically, it must be done from a script.

Answer 2

This can be happily cached by the application server for days without negatively impacting the CSP nonce protection.

No. The nonce should be unique for every request (nonce = number used once).

I guess the only solution is to use non-cached SSI (server side includes) for the script-tags containing the nonce and combinating that with the nonce in the response content security header or another little SSI for the meta http-equiv="Content-Security-Policy"-tag.

This will make every page unique and thus not cacheable.

Answer 3

It depends which server-side cache we're talking about as this has usually many layers. If your application server is caching HTML to save on expensive SQL queries and template processing, then you still can use nonces by modifying the output HTML on the way back. Your templates and in result the generated HTML may contain placeholders like this:

<script nonce="CSP_NONCE_PLACEHOLDER">
...
</script>

This can be happily cached by the application server for days without negatively impacting the CSP nonce protection.

The nonce is then generated dynamically on the web server and replaces the above placeholder without expiring the cached value:

<script nonce="ee4183bb7784017e0ab7d38ab7ef9eb3a75190e0e76ca5daba8cd20104bd8131">
...
</script>

I have been doing it for years on webcookies.org with the web application running on Django, caching in Redis and web server being Nginx. With the latter there are two options:

• use Nginx ngx_http_subs_filter_module and use $ssl_session_id as the nonce:

    sub_filter_once off;
    sub_filter CSP_NONCE_PLACEHOLDER $ssl_session_id;

• use OpenResty module set_secure_random_alphanum to generate the nonce and with ngx_http_sub_module - but the latter is no longer maintained as of 2020

Answer 4

Based on the other answers provided here and everything I can find online, the simple answer is that you cannot use nonce and cache. People have created workarounds, but all of them forfeit some amount of confidence that the nonce is doing its job.

Answer 5

Caching and CSP nonce can be used together in some cases. It depends on these factors:

1. when and where you generate and place the nonce
2. when and where you cache the response

Nonce generation can be done in:

1. Web server like nginx or apache
2. application server like Django, Node.js, Tomcat etc

Caching can be done at different levels:

1. Proxy server caching (Apache/nginx)
2. application server caching like Django, Node.js, Tomcat etc

All you need is nonce generation and placing in response should be done after caching.

If you cache in application server, you can generate and place nonce in Web server. (nginx hints: set_secure_random_alphanum to generate nonce and sub_filter to replace nonce place holder in response from application server. Setting up nonce generation in nginx)

Another option is to cache only the expensive part of response (not the whole page or response) in application server and generate nonce in application server itself after fetching from cache