My CSP worked in dev but I was tempted to add unsafe-inline for prod. A nonce-based policy forces you to keep it strict, so the loosening never happens.
About 1 min of reading
Deploy report-only, read it, then enforce.
Ship the report-only policy and collect what it would block.
Before you run it, say out loud what it will print. Then open the answer.
After reports are clean, switch to the enforcing header.
Before you run it, say out loud what it will print. Then open the answer.
A nonce or hash policy makes strictness the only workable option: to allow your own inline code you name it exactly, so there is no unsafe-inline to reach for. The policy is written so loosening is not a shortcut, it is a rewrite.
Deploy the report-only version first and read the reports, so you learn every source the page actually needs. Then enforce. Enforcing blind breaks the site the moment a needed source is missing from the list.
nonce = secrets.token_hex(16)
csp = "script-src 'self' 'nonce-%s'" % nonceA fresh random nonce per response, put in the header and on each tag you wrote. A forged tag cannot guess it.
script-src 'sha256-9f2a...'For a fixed inline block, hash its content and allow that hash. It is strict and stable, no nonce plumbing needed for unchanging code.
Content-Security-Policy-Report-OnlyShip a report-only CSP first: it logs what it would block without blocking, so you find every violation before you enforce it.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.