“style-src 'self' 'nonce-rAnd0m'” 是否比“style-src 'self' 'unsafe-inline'” 有任何安全优势？

Question

这个页面列出了使用 nonce 比 unsafe-inline 更可取的样式，但是如果除了 style-src 之外的所有东西都使用“default-src 'self'”，那么使用 nonce 有什么好处吗？

Answer 1

The nonce based approach in the link you refer to is just an example, clearly you should use the nonce based approach for both styles and scripts.

This approach is called strict CSP and the advantage with using a nonce, is that you don't need to white-list all the domains. For example, check the CSP policy for twitter.com, its huge!

The CSP for Google docs looks like this, a pretty slim policy:

Content-Security-Policy: 
base-uri 'self';
object-src 'none';
report-uri https://docs.google.com/document/cspreport;
script-src 'report-sample' 'nonce-Y7j7Ul3bnFVzbgVJ0-Tb7a' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';
worker-src 'self' blob: