Skip to main content
Level 2
Oct 30, 2022 8:08 PM UTC
Solved

Set up nonce to have script working on mirror pages

Hi,

We have a script (<script>) inside some of our emails html code, sent from campaign which was working fine until beginning 2022. Now It does not work anymore due to CSP increase it seems. We want to setup nonce as suggested in documentation ( https://experienceleague.adobe.com/docs/experience-platform/tags/client-side/content-security-policy.html?lang=en) to have it functional again. Do you know how to do that? I guess it has to be on the midsourcing as it is supposed to execute on mirror pages?

Thanks for your help

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
nbisoftAccepted solution
Level 2
Jan 13, 2023 6:22 PM UTC

Hello,

Unfortunately no. Adobe support is saying a fix will be released this year hopefully.

4 replies

Adobe Employee
Nov 8, 2022 7:03 AM UTC

Hi @nbisoft,

 

I think you can also setup nonce in your email content by adding a CSP meta tag with nonce value.
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-123abc'" />
</head>


And now you can use the nonce-source to only allow specific inline script blocks for which you will have to set the same nonce on the <script> element
<script nonce="123abc">
var i = 1;
if (i < 50) {
// some code
}
</script>

Translate
nbisoftAuthor
Level 2
Nov 9, 2022 5:54 AM UTC

Hi @jitenders 

Thanks a lot for you answer. I tried that but the setup of the http headers is still needed it seems to authorize the server to execute scripts. I opened a technical case with the support. Hopefully, I will get an answer soon.

Kind regards,

 

 

Translate
Jan 13, 2023 11:24 AM UTC

Hello,

Have you found a solution to your problem?

Translate
nbisoftAuthorAccepted solution
Level 2
Jan 13, 2023 6:22 PM UTC

Hello,

Unfortunately no. Adobe support is saying a fix will be released this year hopefully.

Translate