Expand my Community achievements bar.

Adobe Summit 2025: AEM Session Recordings Are Live! Missed a session or want to revisit your favorites? Watch the latest recordings now.
SOLVED

how to implement nonce for Content-Security-Policy script-src directive in dispatcher

Avatar

Level 2

I am trying to remove  "unsafe-inline" from Content-Security-Policy script-src directive and facing errors while loading them to site. console error says need to add hash or nonce. adding as hash integrity seems to work for few scripts but launch script  and few other scripts are still showing errors.

 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-platform-data/sub-resource-integri...

 

https://experienceleague.adobe.com/en/docs/experience-platform/tags/client-side/content-security-pol...

 

went through above documents , but not able to get complete understanding  on how to generate nonce and add it to scripts and Content-Security-Policy in dispatcher dynamically .

 

Please advice . Thank you 

Topics

Topics help categorize Community content and increase your ability to discover relevant content.

1 Accepted Solution

Avatar

Correct answer by
Community Advisor and Adobe Champion

Hi @Vishnu9,

nonce is supposed to be an unguessable, random value that the server generates individually for each response. Therefore I suggest you define your CSP header in the AEM Publish, instead of Dispatcher.

Here are the high-level steps to follow:

  • Generate an unguessable, random value in AEM individually for each response
  • Return the CSP header including script-src 'nonce-{SERVER-GENERATED-NONCE}'
  • Use the generated nonce for loading your inline script <script nonce='{SERVER-GENERATED-NONCE}'>

 

Good luck,

Daniel

View solution in original post

5 Replies

Avatar

Correct answer by
Community Advisor and Adobe Champion

Hi @Vishnu9,

nonce is supposed to be an unguessable, random value that the server generates individually for each response. Therefore I suggest you define your CSP header in the AEM Publish, instead of Dispatcher.

Here are the high-level steps to follow:

  • Generate an unguessable, random value in AEM individually for each response
  • Return the CSP header including script-src 'nonce-{SERVER-GENERATED-NONCE}'
  • Use the generated nonce for loading your inline script <script nonce='{SERVER-GENERATED-NONCE}'>

 

Good luck,

Daniel

Avatar

Community Advisor

Hi @daniel-strmecki,

 

How do you get around cache issues with this approach? We were able to get nonce added to our scripts but the value is getting cached causing script execution failures upon a mismatch.

 

e.g. Page returns a particular cached nonce value but the script is having some other value due to different TTLs.

 

Thanks,

Ram

Avatar

Community Advisor and Adobe Champion

Hi @rampai,

we use nonces only to allow specific inline scripts to run when a CSP is configured to block all inline scripts by default ('unsafe-inline' not allowed). Therefore, the same HTML response page contains both the CSP header and inline scripts, so they cannot be different. For linked/external scripts, you should specifically list down the domains you allow in the CSP, for example: "script-src 'self' https://cdn.example.com;" 

 

Good luck,

Daniel

 

Avatar

Level 6

@Vishnu9 Adding content-security-policy directly at dispacher level is not best practice. You may have to add it on server level. In your case on publisher instance. 

 

Sample policy https://experienceleague.adobe.com/en/docs/experience-platform/tags/client-side/content-security-pol...

 

content-security-policy:
default-src 'none';
object-src 'self';
script-src 'self';
connect-src 'self';
img-src 'self' ;
font-src 'self';
media-src 'self';

You can add the configuration in Sling main servlet. additional headers,

sling.additional.response.headers
https://www.javadoc.io/static/org.apache.sling/org.apache.sling.engine/2.3.8/index.html?org/apache/s...

Hope that helps.

Avatar

Administrator

@Vishnu9 Did you find the suggestions helpful? Please let us know if you require more information. Otherwise, please mark the answer as correct for posterity. If you've discovered a solution yourself, we would appreciate it if you could share it with the community. Thank you!



Kautuk Sahni