Selective CSP Nonce

[MitchellTe1]

The site in question does using use or apply CSP Nonce on every section or page, however the guidance on enabling CSP Nonce is to add a configuration in the Core library and add a data element. Is there another way to get Nonce added to Core dynamically instead of universally, using a Rule and custom code? 

Initially we applied CSP Nonce universally and several site sections broke; ideas and guidance to create an alternate solution are appreciated.

Ref:

  https://experienceleaguecommunities.adobe.com/t5/adobe-analytics-questions/csp-nonce-in-core-extensi... 

  https://experienceleaguecommunities.adobe.com/t5/adobe-analytics-questions/adobe-analytics-scripts-b... 

  https://experienceleague.adobe.com/en/docs/experience-platform/tags/client-side/content-security-pol... 

[yuhuisg]

Since your nonce is generated per page, then you can still make it work with the Core extension. Recall that when your web page is loaded, the Launch library gets loaded too. This causes the Core extension to also be loaded, and when it does, it can get the nonce from your data element.

So, the following should work:

1. Ask your developers to make the nonce known somewhere in the web page. If you're using a data layer, then they can set the nonce in the data layer for you to read from. It is important that your developers make the nonce available in the HTML before the code that loads your Launch library.
2. Create a data element in Launch, according to how your developers are making the nonce known for you from step 1. If it's with the data layer, then create your data element to read the nonce from the data layer.
3. In the Core extension, use your data element from step 2.

Now, when the page is loaded, then since the nonce is made known when your Launch library loads, then the Core extension should be able to get the nonce properly through your data element.

Hope that works.