1

Some websites use Content-Security-Policy nonces in order to include inline styling and script in their webpages.

Is the CSP nonce feature designed to be used for production use, or is it simply there as a stop-gap solution in order to help facilitate the potentially long and complex transition to a fully locked down CSP?

1

In so far as major browser support and working as advertised, then yes CSP nonce is suitable for production use. For cases where business reasons prevent changes to the website then it is still superior to not having a CSP or one that allows all unsafe-inline sources.

However as you hint at, using inline sources should be avoided where possible and nonces are meant as one way to work around the problem. The CSP specification even goes to note:

Using a nonce to whitelist inline script or style is less secure than not using a nonce, as nonces override the restrictions in the directive in which they are present. An attacker who can gain access to the nonce can execute whatever script they like, whenever they like. That said, nonces provide a substantial improvement over 'unsafe-inline' when layering a content security policy on top of old code. When considering 'unsafe-inline', authors are encouraged to consider nonces (or hashes) instead.

One of the biggest security benefits of CSP is exactly to prevent the running of inline scripts and inline styles. Hence the nonce and hash solutions should only be used if you really have no other choice.

  • 1
    Thanks for the valuable info, this has concreted my decision to not use nonces, and instead have everything in dedicated CSS files. – rubberband876 Jan 31 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.