Ever since CSP 3 introduced
strict-dynamic, Google has recommended its usage. Indeed, the idea of maintaining one "root" script, which in turn loads all other necessary scripts, sets up event handlers, etc. instead of maintaining a whitelist of allowed domains or hashes for every inline script seems positive.
However, whenever I read about
strict-dynamic, I always read about the inclusion of a nonce. This can prove to be difficult, if for instance the page is generated by an application server, yet the header is added via a reverse proxy later down the line.
In order to mitigate this, I tried to use the other mechanism to identify scripts: hashes. More specifically, the
The complete Conent Security Policy would look like this then:
script-src 'strict-dynamic' 'sha256-XBQNNdy0amIuLO3171zDY4zf/RwRjJMx+MhGafC3R4M=' 'unsafe-inline' http: https:; object-src 'none'; base-uri 'none'; report-uri https://csp.example.com;
Is there any reason why this might be less safe than a nonce-based approach?