CSP generator
Start from a policy that works. The strict preset uses a nonce with
'strict-dynamic', which is the only common approach that is not trivially
bypassable.
connect-src and img-src,
not script-src. Adding a host to script-src on a nonce-based policy
reintroduces exactly the bypass the nonce was preventing.Generating the nonce
Replace {NONCE} with a fresh random value on every response, and
put the same value on each of your inline script tags. It must be unguessable and it must change
per response — a nonce baked into a static file at build time is not a nonce, it is a password
the attacker can read.
const nonce = crypto.randomUUID();
res.setHeader('Content-Security-Policy', policy.replace('{NONCE}', nonce));
This means CSP with a nonce cannot be set at the CDN edge alongside your other headers — it has to come from the application, because only the application can vary it per response.
Deploy it report-only first
Send it as Content-Security-Policy-Report-Only with a reporting endpoint, watch for
a week or two, then switch to the enforcing header. Fix violations by adding nonces to your own
scripts, not by widening the policy — every widening is permanent.
Full rollout guide →