Roll out CSP with Report-Only

# Place inside the intended test server {} block.
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always;

Validate the test configuration with nginx -t. Inspect the response header in Network and violations in Console. Report-Only does not block resources. Inline styles, external services and frames need application-specific review and carefully scoped allowances.

Run python nonce_server.py to inspect the relationship between response header and markup. secrets generates the nonce and the same value appears in that response’s header and script. The page has no external dependencies.

# nonce_server.py; localhost demonstration.
from http.server import BaseHTTPRequestHandler, HTTPServer
from secrets import token_urlsafe

ENFORCE = False

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        nonce = token_urlsafe(24)
        policy = (
            "default-src 'none'; "
            f"script-src 'nonce-{nonce}'; "
            "object-src 'none'; base-uri 'none'; "
            "form-action 'self'; frame-ancestors 'none'"
        )
        body = (
            '<!doctype html><meta charset="utf-8"><title>Nonce demo</title>'
            '<h1>CSP nonce exercise</h1><output>Waiting</output>'
            f'<script nonce="{nonce}">'
            'document.querySelector("output").textContent="Script executed";'
            '</script>'
        ).encode()
        self.send_response(200)
        header = "Content-Security-Policy" if ENFORCE else "Content-Security-Policy-Report-Only"
        self.send_header(header, policy)
        self.send_header("Cache-Control", "no-store")
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

if __name__ == "__main__":
    HTTPServer(("127.0.0.1", 8767), Handler).serve_forever()

Open http://127.0.0.1:8767 and expect Script executed. Reloading changes the nonce. no-store prevents reuse in this demonstration; cached HTML requires an explicit strategy that keeps its body and policy synchronized.

A correct header alone is insufficient; the script attribute must match it. This check fetches two responses, verifies each header/body pair and then checks rotation across responses.

# Run while nonce_server.py is listening.
import re
import urllib.request

def snapshot():
    with urllib.request.urlopen("http://127.0.0.1:8767", timeout=2) as response:
        policy = response.headers.get("Content-Security-Policy-Report-Only")
        if policy is None:
            policy = response.headers["Content-Security-Policy"]
        page = response.read().decode()
    header_nonce = re.search(r"'nonce-([^']+)'", policy).group(1)
    tag_nonce = re.search(r'<script nonce="([^"]+)"', page).group(1)
    assert header_nonce == tag_nonce
    return header_nonce

first, second = snapshot(), snapshot()
assert first != second
print("Matching, fresh nonces verified")

Expect Matching, fresh nonces verified. This is a textual contract check, not a browser enforcement test. Also exercise allowed execution and blocking of an unnonced script in an enforcing browser test.

Install the listener in an already allowed script. Exercise Report-Only first, then ENFORCE=True in the local test server. disposition distinguishes observation from enforcement.

// Put this in an already permitted script before the test interaction.
window.addEventListener("securitypolicyviolation", event => {
  console.table({
    directive: event.effectiveDirective,
    resource: event.blockedURI,
    disposition: event.disposition,
  });
});

// In nonce_server.py, switch ENFORCE to True only in the test environment.
// Reload and verify the response uses Content-Security-Policy.
// An inline script without the matching nonce must then be blocked.

Before broad enforcement, test sign-in, forms, uploads, errors and external services. blockedURI can contain path information; this example writes only to the local console. Keep the tested policy version and rollback path with the report.