Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You need to modify the code to generate and pass a nonce value to the script attribute in the ASAP code snippet.
What is a nonce?
A nonce with respect to content security policy is a word or phrase used only once, and it should be so random that they are unpredictable. For example, a nonce should be a cryptographically strong random value that is at least 128 bits in length. It is also necessary that a new nonce is generated for every page load to prevent attackers from injecting arbitrary scripts bypassing CSP.
Why should you use nonces?
When you use CSP, you will need to add a nonce to every inline script block. The nonce lets the browser know that the server intended on serving this script block only if the nonce attribute in the script tag matches the nonce value in the CSP header. This way, you can use it to detect and mitigate the likes of Cross-Site Scripting (XSS) and data injection attacks.
How to generate nonce values?
From your web server, generate a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. Note that you must generate nonces differently each time the page loads (but, nonce only once). Here are some examples:
Nodejs Script:
const var = require( 'crypto' );
var.randomBytes(16).toString( 'base64' );
// '6JDFIvPbrWANKpSJ8vlv6b=='
Java Script:
String nonce = new String(DigestUtils.md5Hex(String.valueOf(new SecureRandom().nextLong())));
def GetCspNonce():
"""Returns a random nonce."""
NONCE_LENGTH = 16
return base64.b64encode(os.urandom(NONCE_LENGTH))
Now that you have generated a nonce value, the next step is to:
- Pass the nonce value to the script-src directive of the Content-Security-Policy header (prepend nonce-).
- Pass the same nonce value to the script attribute in the ASAP code snippet.