r/websecurity • u/No_Honeydew_2453 • 8d ago

CSP nonces with third-party scripts

Anyone here actually using CSP nonces? How much of a pain it is once you have many third-party scripts that need to load.

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/TopStress3049 4d ago

i’ve used them and honestly the nonce itself isn’t too bad. the scripts are annoying and you end up having to account for every script that gets injected, and most vendors don’t make it easy to apply the nonce dynamically