Consider having ContentSecurityPolicyHeaderWriter supply a script nonce

[jzheaux]

In order to have inline scripts and use a strict CSP, it's important to provide a nonce.

Spring Security's ContentSecurityPolicyHeaderWriter could generate a nonce if a {nonce} placeholder is in the policy directive configuration.

Then, it could be made available as a request attribute for use in views.

[ziqin]

Instead of a {nonce} placeholder in the directives string, would it be a better idea to accept a Function<String, String> in ContentSecurityPolicyConfig?

@Bean
SecurityFilterChain filterChain(HttpSecurity http) {
    http
        .headers(headers -> headers
            .contentSecurityPolicy(csp -> csp
                .nonceAttributeName("_csp_nonce")
                .policyDirectivesWithNonce(nonce -> "script-src 'self' 'nonce-" + nonce + "'")
            )
        );
    return http.build();
}

[ziqin]

I tried to implement nonce support in two approaches. It turns out that the {nonce} placeholder approach can be implemented with less changes under the constraint of not breaking existing APIs.

[ziqin]

Hi, @jzheaux!

I have implemented the {nonce} approach in PR #18499. Would you like to review it?