To set up strict-dynamic CSP source it's required to maintain a unique nonce value per request. The recommended way to do it according to this article is with:
set_secure_random_alphanum $cspNonce 32;
Though I'm using official nginx docker image, which does not have nginx_set_misc module installed and this line fails with error:
nginx: [emerg] unknown directive "set_secure_random_alphanum" in /etc/nginx/security-headers-master.conf:54
I have two options:
– install not official nginx image with lua support,
– use available nginx variable, e.g. $request_id, as a nonce value.
As far as I see according to nginx documentation it can fit:
$request_id – unique request identifier generated from 16 random bytes, in hexadecimal (1.11.0)
Please share your thoughts about it.