Use case indexS1 · CSP nonce verification · browser + command line verification

S1 — CSP nonce injection

Same origin HTML, rewritten with one per-response nonce on every eligible <script> and a matching Content-Security-Policy header. Scripts inside <noscript> are not nonced.

Direct originRewrite Worker
Open page s1-origin…/ s1…/ (protected document)
CSP header none script-src 'nonce-…' 'strict-dynamic'; …
Script tags 50+ scripts; one stale old-origin-nonce Eligible scripts share one fresh nonce per request
Browser verification

Run a read-only check in this browser. The result explains the response evidence; use the command-line section below for deeper inspection.

Not run yet.

1. Browser verification

Open direct origin Open rewrite Worker Rewrite Worker /gzip Rewrite Worker /br
  1. On the protected page: DevTools → Network → document → Response Headers → copy content-security-policy.
  2. View Source: every eligible <script> has nonce="…" matching that header.
  3. Confirm old-origin-nonce is gone; scripts inside <noscript> have no nonce.
  4. Reload: nonce value changes; response is private, no-store.
  5. Console: no script-src CSP violations on the success path.

2. Command-line verification (copy and run)

# Before — typically no CSP
curl -sI https://s1-origin.thecompany-lab.com/ | grep -i content-security-policy || echo "(no CSP)"

# After — CSP + nonces
curl -sI https://s1.thecompany-lab.com/ | grep -i content-security-policy
curl -s https://s1.thecompany-lab.com/ | grep -o 'nonce="[^"]*"' | sort | uniq -c | head
# Expect many scripts sharing ONE distinct nonce value
curl -s https://s1.thecompany-lab.com/ | grep -c 'old-origin-nonce'   # expect 0
curl -sI https://s1.thecompany-lab.com/ | grep -i cache-control

Pass criteria