0

I want to create server-side CSP nonce for my site

my web server is Nginx

I've written two methods for those

A) using a directive in Nginx with set-misc-nginx-module

set_secure_random_alphanum $cspNonce 32; 
add_header Content-Security-Policy "base-uri 'self'; default-src 'self' 'unsafe-inline' https://www.google-analytics.com ; script-src 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; style-src 'unsafe-inline' https://www.googletagmanager.com  https://fonts.googleapis.com/ https://www.google.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; img-src 'unsafe-inline' https://ssl.gstatic.com/  example.com/images/ https://stats.g.doubleclick.net https://www.google-analytics.com/ ; frame-src example.com/phoenix/live_reload/frame https://www.gstatic.com/ https://www.google.com/ https://www.googletagmanager.com/ns.html ; font-src 'self' https://example.com/fonts/  https://fonts.gstatic.com ; connect-src www.google-analytics.com https://www.google-analytics.com https://stats.g.doubleclick.net ; object-src 'none';" always;  
sub_filter_once off;  
sub_filter_types *;  
sub_filter CSP_NONCE $cspNonce; 

and in my app code I have like this:

<script nonce="CSP_NONCE">...</script>  

B) using Lua in Nginx

location / {
    [...]

    set_by_lua_block $cspNonce  {
        local basexx = require('basexx')
        local file = assert(io.open('/dev/urandom', 'rb'))
        local bytes = file:read(32)
        file:close()
        return basexx.to_base64(bytes)
    }

    [...]
}

set_secure_random_alphanum $cspNonce 32; 
add_header Content-Security-Policy "base-uri 'self'; default-src 'self' 'unsafe-inline' https://www.google-analytics.com ; script-src 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; style-src 'unsafe-inline' https://www.googletagmanager.com  https://fonts.googleapis.com/ https://www.google.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; img-src 'unsafe-inline' https://ssl.gstatic.com/  example.com/images/ https://stats.g.doubleclick.net https://www.google-analytics.com/ ; frame-src example.com/phoenix/live_reload/frame https://www.gstatic.com/ https://www.google.com/ https://www.googletagmanager.com/ns.html ; font-src 'self' https://example.com/fonts/  https://fonts.gstatic.com ; connect-src www.google-analytics.com https://www.google-analytics.com https://stats.g.doubleclick.net ; object-src 'none';" always;
sub_filter_once off;
sub_filter_types text/html;
sub_filter_last_modified on;
sub_filter '<script' '<script nonce="$cspNonce"';
sub_filter '<style' '<style nonce="$cspNonce"';

my priority is security and performance, which one is better?

  • anybody can help me? – constantine Dec 26 '18 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.