1

Here is an example of the CSP of accounts.google.com:

content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport

The "nonce" means it will add a whitelist to a script that has the unique ID of "DanEwkxkS1rktq35Z1hVcg" (if I understand correctly). But after that, they allow use of inline script tags as well as the eval() function (through "unsafe-inline" and "unsafe-eval" respectively). So what's the point of giving a specific whitelist to a script with ID "DanEwkxkS1rktq35Z1hVcg", but also allowing all inline scripts? Do I fundamentally misunderstand something about how CSP works?

0

"A whitelist for specific inline scripts using a cryptographic nonce (number used once). The server must generate a unique nonce value each time it transmits a policy. It is critical to provide an unguessable nonce, as bypassing a resource’s policy is otherwise trivial. See unsafe inline script for an example. Specifying nonce makes a modern browser ignore 'unsafe-inline' which could still be set for older browsers without nonce support."

The biggest advantage CSP brings is preventing inline JavaScript. With this directive, they are overriding this protection for older browsers and it probably means that they couldn't completely re-write the client side of this application so it no longer depends on inline JavaScript. Instead, they are relying on the site (hopefully) being coded to prevent cross-site scripting. Using script-src Nonce allows modern browsers to allow inline scripts tagged with the matching nonce and disallow all others.

The page needs certain inline scripts to work. Older browsers don't know about Nonces so to ensure the page still works in older browsers, 'unsafe-inline' is there. Older browsers will allow all unsafe inline. Modern browsers will only allow the nonced scripts.

This Stack Overflow answer is good one about nonces.

StackOverflow had a similar discussion.

  • Okay, I'm glad to hear that I understand that part. Is the "nonce" completely irrelevant then? Because if I understand correctly, a "nonce" only matters if inline scripts would be otherwise disallowed by the CSP? – Weastie Mar 20 at 21:15
  • "A whitelist for specific inline scripts using a cryptographic nonce (number used once). The server must generate a unique nonce value each time it transmits a policy. It is critical to provide an unguessable nonce, as bypassing a resource’s policy is otherwise trivial. See unsafe inline script for an example. Specifying nonce makes a modern browser ignore 'unsafe-inline' which could still be set for older browsers without nonce support." – mcgyver5 Mar 20 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.