content_security_policy_nonce calls Rails method so CSP does not contain nonce #511

Activity

1. adeherdt-r7 commented on Jul 23, 2024

   

   adeherdt-r7

   on Jul 23, 2024

   Last edited by adeherdt-r7

   More actions

   I am running into a similar problem.
   We use something like this to inject nonce headers:

     def include_gon_jquery(opts={})
       opts.merge!(need_tag:false)
   
       init_gon = <<eos
       jQuery(function($){
         #{Gon::Base.render_data(opts)}
       })
   eos
   
       nonced_javascript_tag init_gon
     end
   

   And Firefox keeps reporting that this is being blocked because of the Content-Security-Policy.
   This is our configuration:

     config.csp = {
       default_src:      %w('self'),
       img_src:          %w('self' data:),
       frame_src:        %w('self'),
       connect_src:      %w('self' https://mydomain.com),
       font_src:         %w('self'),
       media_src:        %w('self'),
       object_src:       %w('self'),
       style_src:        %w('self' 'unsafe-inline' 'inline'),
       script_src:       %w('self' 'unsafe-eval' 'eval' 'nonce'),
       script_src_elem:  %w('self' 'unsafe-eval' 'eval' 'nonce'),
     }
   

   The core problem seems to be that the nonced_javascript_tag is not setting the correct nonce value inside the CSP header, as the browser doesn't have the value. Checking the source code however does reveal that the generated <script> tag contains the nonce value.
2. adeherdt-r7 commented on Jul 24, 2024

   

   adeherdt-r7

   on Jul 24, 2024

   More actions

   I'd like to add that this issue was a Firefox problem for me, and actually caused by caching.
   Wiping out the cache in Firefox and forcing a hard reload made it all work.
3. fletchto99

   assigned

   Copilot

   and

   fletchto99

   on Dec 17, 2025