My relevant CSP in .htaccess is

Header always set Content-Security-Policy "upgrade-insecure-requests; \
  default-src 'self'; \
  img-src https: data:; \
  object-src 'none'; \
  script-src 'self' https://googletagmanager.com https://stackpath.bootstrapcdn.com; \
  style-src 'self' 'unsafe-inline' https://stackpath.bootstrapcdn.com https://cdn.jsdelivr.net; \
  font-src 'self' https://stackpath.bootstrapcdn.com https://cdn.jsdelivr.net; \
  connect-src 'self' https://www.google-analytics.com; \
  form-action 'self' https://www.paypal.com; \
  frame-ancestors 'self'; base-uri 'self'"

I want to add a nonce for the scripts, I have tried this and it appears to pass CSP checking websites. But I was not expecting to see this line in the source for the page in the browser.

  <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-RANDOM'">

Yes, I know it needs to be a random string. I am trying to get the process working first.

Is this the correct way to do it?

After deploying it, I see that the entry in .htaccess for script-src is replaced, so self and google do not work.

Is there a way to add the page CSP to the .htaccess one?


1 Answer 1


It looks like when multiple policies are present, the more restrictive ones are used. That is, I can only restrict the policy in the meta tag.

8.1. The effect of multiple policies This section is not normative.

The above sections note that when multiple policies are present, each must be enforced or reported, according to its type. An example will help clarify how that ought to work in practice. The behavior of an XMLHttpRequest might seem unclear given a site that, for whatever reason, delivered the following HTTP headers:

Content-Security-Policy: default-src 'self' http://example.com http://example.net; connect-src 'none'; Content-Security-Policy: connect-src http://example.com/; script-src http://example.com/ Is a connection to example.com allowed or not? The short answer is that the connection is not allowed. Enforcing both policies means that a potential connection would have to pass through both unscathed. Even though the second policy would allow this connection, the first policy contains connect-src 'none', so its enforcement blocks the connection. The impact is that adding additional policies to the list of policies to enforce can only further restrict the capabilities of the protected resource.

To demonstrate that further, consider a script tag on this page. The first policy would lock scripts down to 'self', http://example.com and http://example.net via the default-src directive. The second, however, would only allow script from http://example.com/. Script will only load if it meets both policy’s criteria: in this case, the only origin that can match is http://example.com, as both policies allow it.

Policy in meta element

Effect of Multiple Policies

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.