如何使用 PHP 标头方法在 PHP 中使用 WordPress Nonce 实现内容安全策略？

Question

Currently I am trying to implement a Content Security Policy on a WordPress Landing page. I am using the following header-method in PHP to implement a Content Security Policy:

header("Content-Security-Policy:default-src 'none'; script-src 'nonce-RandomSeq' 'nonce-hzthedtrh5' 'nonce-hjjftzrf56zf'  ... ")

And I am attempting to use WordPress Nonce to create random nonces for a inline Javascript code

<?php
$nonce = wp_create_nonce( 'my-nonce' ); ?>

<script type="text/javascript" nonce="<?php echo $nonce; ?>">
  // some javascript code
</script>

This example works when I specifiy the nonce with a string like "435234JHHJK2", but when I try to put a variable in the header like this:

header("Content-Security-Policy:default-src 'none'; script-src 'nonce-".$nonce."' 'nonce-hzthedtrh5' 'nonce-hjjftzrf56zf'  ... ")

The random nonce, created by wp-nonce is not recognized and the given script won't be executed.

So what am I doing wrong?

Answer 1

Found the solution:

PHP does not accept variables in single quotes liike in 'noce-".$nonce."' Solution is to save the whole in CSP information in an external string variable:

$csp = "Content-Security-Policy: script-src  'nonce-".$nonce1."' 'nonce-".$nonce2."'...";

and to include this variable into the PHP header method:

header( "{$csp}");