feat: Enable CSP with nonce

adobe · Feb 11, 2025 · 025d6b1 · 025d6b1
1 parent 8ffdad1
commit 025d6b1
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 7 deletions.
diff --git a/404.html b/404.html
@@ -2,15 +2,20 @@
 <html>
 
 <head>
+  <meta
+    http-equiv="Content-Security-Policy"
+    content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+    move-as-header="true"
+  >
   <title>Page not found</title>
-  <script type="text/javascript">
+  <script nonce="aem" type="text/javascript">
     window.isErrorPage = true;
     window.errorCode = '404';
   </script>
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta property="og:title" content="Page not found">
-  <script src="/scripts/scripts.js" type="module" crossorigin="use-credentials"></script>
-  <script type="module">
+  <script nonce="aem" src="/scripts/scripts.js" type="module" crossorigin="use-credentials"></script>
+  <script nonce="aem" type="module">
     window.addEventListener('load', () => {
       if (document.referrer) {
         const { origin, pathname } = new URL(document.referrer);
@@ -26,7 +31,7 @@
       }
     });
   </script>
-  <script type="module">
+  <script nonce="aem" type="module">
     import { sampleRUM } from '/scripts/lib-franklin.js';
     import { applyRedirects } from '/scripts/redirects.js';
     await applyRedirects();

diff --git a/head.html b/head.html
@@ -1,6 +1,11 @@
 <!-- v7 -->
+<meta
+  http-equiv="Content-Security-Policy"
+  content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+  move-as-header="true"
+>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
-<script src="/scripts/lib-franklin.js" type="module"></script>
-<script src="/scripts/scripts.js" type="module"></script>
-<script src="/scripts/indexing-test.js?date=2024-08-16" type="module"></script>
+<script nonce="aem" src="/scripts/lib-franklin.js" type="module"></script>
+<script nonce="aem" src="/scripts/scripts.js" type="module"></script>
+<script nonce="aem" src="/scripts/indexing-test.js?date=2024-08-16" type="module"></script>
 <link rel="stylesheet" href="/styles/styles.css"/>