如何使用 AWS Lambda + CloudFront + S3 设置为内联脚本/样式动态添加 CSP 随机数属性？

Question

According to official AWS documentation , I can add static Content-Security-Policy headers via AWS Lambda. But I'd like to know if there's a way to add dynamic nonce-<base64-value> and change every time the viewer refresh the page?

This is how I add CSP headers via Node.js:

'use strict';
exports.handler = (event, context, callback) => {

    //Get contents of response
    const response = event.Records[0].cf.response;
    const headers = response.headers;

    //Set new headers 
    headers['content-security-policy'] = [{key: 'Content-Security-Policy', value: "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'"}]; 

    //Return modified response
    callback(null, response);
};

But how can I get the response body from Lambda?

Answer 1

As I know there is a checkbox in CloudFront configuration with "Send response body to lambda"