night oriole
I want to replace 'unsafe-inline' in the script-src directive with per-request nonces, so injected <script> tags no longer execute even if an attacker bypasses input sanitization.
Layer: browser-enforced via Content-Security-Policy header generated per request by Next.js middleware.
and AI tells me that there's a **risk **or two for this:
Two things commonly break: Payload admin (uses inline handlers) and any third-party script that doesn't accept a nonce. Which looks that my solution would break this.
Anyone has done this before?
Is this way of doing it correct?
Is there something I'm missing or what?
Any idea would help me 🫶
kindred void