3

I run a website with inline javascript.

I created a security policy so javascript can run inline. Then Pagespeed insights shows this issue:

screenshot from pagespeed insights

When I read about CSP nonces and hashes, it means generating a unique value both in the HTTP header (where the policy is defined) and in the HTML.

The thing is, my HTML pages are generated with PHP once then saved as cached HTML files so they load faster on subsequent requests. but if I have to assign unique values to satisfy CSP and google, then I would need to break my cache every time.

How do I go about satisfying google here without destroying the cache?

Improve this question

1 Answer 1

Reset to default
1

Try using strict-dynamic in your security policy.

With it, you can dynamically load resources while maintaining security, and you can do without unique nons for each request.

You can read more about it here.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.