feat: Enable CSP with nonce (#776)

andreituicu · web-flow · commit 4d95f3b9c887 · 2025-02-13T11:21:30.000-08:00
diff --git a/404.html b/404.html
@@ -2,15 +2,20 @@
 <html>
 
 <head>
+  <meta
+    http-equiv="Content-Security-Policy"
+    content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+    move-as-header="true"
+  >
   <title>Page not found</title>
-  <script type="text/javascript">
+  <script nonce="aem" type="text/javascript">
     window.isErrorPage = true;
     window.errorCode = '404';
   </script>
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta property="og:title" content="Page not found">
-  <script src="/scripts/scripts.js" type="module" crossorigin="use-credentials"></script>
-  <script type="module">
+  <script nonce="aem" src="/scripts/scripts.js" type="module" crossorigin="use-credentials"></script>
+  <script nonce="aem" type="module">
     window.addEventListener('load', () => {
       if (document.referrer) {
         const { origin, pathname } = new URL(document.referrer);
@@ -26,7 +31,7 @@
       }
     });
   </script>
-  <script type="module">
+  <script nonce="aem" type="module">
     import { sampleRUM } from '/scripts/lib-franklin.js';
     import { applyRedirects } from '/scripts/redirects.js';
     await applyRedirects();
diff --git a/head.html b/head.html
@@ -1,6 +1,11 @@
 <!-- v7 -->
+<meta
+  http-equiv="Content-Security-Policy"
+  content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+  move-as-header="true"
+>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
-<script src="/scripts/lib-franklin.js" type="module"></script>
-<script src="/scripts/scripts.js" type="module"></script>
-<script src="/scripts/indexing-test.js?date=2024-08-16" type="module"></script>
-<link rel="stylesheet" href="/styles/styles.css"/>
+<script nonce="aem" src="/scripts/lib-franklin.js" type="module"></script>
+<script nonce="aem" src="/scripts/scripts.js" type="module"></script>
+<script nonce="aem" src="/scripts/indexing-test.js?date=2024-08-16" type="module"></script>
+<link rel="stylesheet" href="/styles/styles.css"/>
