CSP strict-dynamic
CSP strict-dynamic trusts scripts dynamically added by scripts already allowed via nonce/hash, removing the need to whitelist each dynamic script.
Purpose
To simplify CSP deployment for SPAs and dynamic scripts, trusting scripts loaded by trusted scripts.
Mechanism
With script-src 'nonce-abc' 'strict-dynamic': scripts carrying the nonce may dynamically insert <script> tags that are automatically trusted (propagated trust), without whitelisting them. Injected untrusted scripts still lack the nonce and remain blocked.
Use cases
- SPA CSP deployment
- Dynamic script trust
- CSP simplification