0

I want to create server-side CSP nonce for my site

my web server is Nginx

I've written two methods for those

A) using a directive in Nginx with set-misc-nginx-module

set_secure_random_alphanum $cspNonce 32; 
add_header Content-Security-Policy "base-uri 'self'; default-src 'self' 'unsafe-inline' https://www.google-analytics.com ; script-src 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; style-src 'unsafe-inline' https://www.googletagmanager.com  https://fonts.googleapis.com/ https://www.google.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; img-src 'unsafe-inline' https://ssl.gstatic.com/  example.com/images/ https://stats.g.doubleclick.net https://www.google-analytics.com/ ; frame-src example.com/phoenix/live_reload/frame https://www.gstatic.com/ https://www.google.com/ https://www.googletagmanager.com/ns.html ; font-src 'self' https://example.com/fonts/  https://fonts.gstatic.com ; connect-src www.google-analytics.com https://www.google-analytics.com https://stats.g.doubleclick.net ; object-src 'none';" always;  
sub_filter_once off;  
sub_filter_types *;  
sub_filter CSP_NONCE $cspNonce; 

and in my app code I have like this:

<script nonce="CSP_NONCE">...</script>  

B) using Lua in Nginx

location / {
    [...]

    set_by_lua_block $cspNonce  {
        local basexx = require('basexx')
        local file = assert(io.open('/dev/urandom', 'rb'))
        local bytes = file:read(32)
        file:close()
        return basexx.to_base64(bytes)
    }

    [...]
}

set_secure_random_alphanum $cspNonce 32; 
add_header Content-Security-Policy "base-uri 'self'; default-src 'self' 'unsafe-inline' https://www.google-analytics.com ; script-src 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; style-src 'unsafe-inline' https://www.googletagmanager.com  https://fonts.googleapis.com/ https://www.google.com/recaptcha/ 'strict-dynamic' 'nonce-$cspNonce' ; img-src 'unsafe-inline' https://ssl.gstatic.com/  example.com/images/ https://stats.g.doubleclick.net https://www.google-analytics.com/ ; frame-src example.com/phoenix/live_reload/frame https://www.gstatic.com/ https://www.google.com/ https://www.googletagmanager.com/ns.html ; font-src 'self' https://example.com/fonts/  https://fonts.gstatic.com ; connect-src www.google-analytics.com https://www.google-analytics.com https://stats.g.doubleclick.net ; object-src 'none';" always;
sub_filter_once off;
sub_filter_types text/html;
sub_filter_last_modified on;
sub_filter '<script' '<script nonce="$cspNonce"';
sub_filter '<style' '<style nonce="$cspNonce"';

my priority is security and performance, which one is better?

  • anybody can help me? – constantine Dec 26 '18 at 16:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.