Live data from Hacker News

Accessing the nonce from JavaScript, makes all nonce based CSPs strict-dynamic

Post reply on HN

Print view View original

1–2 of 2 posts

Accessing the nonce from JavaScript, makes all nonce based CSPs strict-dynamic

#1

Post by bandamo » Tue, Sep 27, 2022, 8:55 AM UTC

Accessing the nonce from JavaScript, makes all nonce based CSPs strict-dynamic
github.com

Re: Accessing the nonce from JavaScript, makes all nonce based CSPs strict-dynamic

#2

Post by bandamo » Tue, Sep 27, 2022, 9:00 AM UTC

Stumbled upon this and seems like a security issue. Why do browser not block the access to the nonce attribute?

Post reply on HN