CSP nonces (per-response)

Opt in per site ([security] csp_nonce) to inject a fresh per-response nonce into inline <script>/<style> via the native HTMLRewriter, plus a Content-Security-Policy-Report-Only header referencing it. Report-only never blocks — the safe first step of a CSP rollout. Default off: other sites are byte-identical.

Tip

Live on webdesign29.net: the header nonce matches the body nonce (same request), differs per request, and the page stays gzip-compressed and functional. The ISR-cached body differs per response, so the compressed variant cache is bypassed only for opted-in sites. See also the HTMLRewriter demo.

Opt in

bext.config.tomlTOML

# bext.config.toml — opt in (default off; report-only, never blocks)
[security]
csp_nonce = true

At serve time

responseCode

// At each serve point (cache-hit + fresh), for an opted-in site, the PRISM
// pipeline injects a FRESH per-response nonce into inline <script>/<style>
// via the native HTMLRewriter, and sets a matching report-only header:

<script nonce="ea6100246424b38c10a05d61cf43a04e"> … </script>
<style  nonce="ea6100246424b38c10a05d61cf43a04e"> … </style>

Content-Security-Policy-Report-Only:
  script-src 'self' 'nonce-ea6100246424b38c10a05d61cf43a04e';
  style-src  'self' 'nonce-ea6100246424b38c10a05d61cf43a04e'