S1 — CSP nonce verification

S1 — CSP nonce injection

Same origin HTML, rewritten with one per-response nonce on every eligible <script> and a matching Content-Security-Policy header. Scripts inside <noscript> are not nonced.

Key questions

Question

How does one nonce stay correct and isolated per response?

The Worker creates one nonce, shares it with the HTMLRewriter handler and CSP header, and gates scripts inside <noscript>.

Success criteria / proof

CSP policy is present.Capability response carries one nonce-bearing script policy with the required base directives.
Eligible scripts share the CSP nonce.Browser check compares nonce attributes with the response header and confirms the stale origin nonce is replaced.
Script behavior is preserved.Workers-pool tests cover module, defer, async, crossorigin, and integrity attributes.
Noscript content stays gated.Scripts inside <noscript> are not given a nonce.
Compressed fixtures remain valid./gzip and /br are transformed with identity body policy and safe response headers.
Failure and cache paths are safe.Per-response nonce isolation, private no-store caching, and transform failure behavior are covered by tests.

1. Browser verification

Test the baseline first, then the capability response. Each column shows the request, observed values, and the success criterion it exercises.

Before · Direct Origin

The origin should have no CSP and should retain its stale nonce.

Not run yet.

After · Capability Worker

The response should add the CSP and match one fresh nonce to every eligible script.

Not run yet.

Run both columns to compare the responses.

2. Command-line verification (copy and run)

Step 1 — Capture the before response

Request the direct origin. The visible page and response should have no CSP and should retain the stale origin nonce.

curl -sS -D /tmp/s1-before.headers   -o /tmp/s1-before.html https://s1-origin.thecompany-lab.com/
grep -iE '^(HTTP|content-security-policy|content-type)' /tmp/s1-before.headers || true
grep -o 'old-origin-nonce' /tmp/s1-before.html | wc -l

Step 2 — Capture the after response

Request the capability Worker and compare the policy-bearing header with the nonce attributes in its document.

curl -sS -D /tmp/s1-after.headers   -o /tmp/s1-after.html https://s1.thecompany-lab.com/
grep -iE '^(HTTP|content-security-policy|cache-control|x-rs-transform-encoding)' /tmp/s1-after.headers
grep -o 'nonce="[^"]*"' /tmp/s1-after.html | sort | uniq -c

Step 3 — Verify the replacement

The same fresh nonce should appear on every eligible script, while the stale value should be gone.

grep -c 'old-origin-nonce' /tmp/s1-after.html   # expect 0
grep -o 'UNPROTECTED ORIGIN' /tmp/s1-after.html || true
grep -o 'PROTECTED CAPABILITY' /tmp/s1-after.html

Step 4 — Verify compressed-origin fixtures

The Worker should report identity transform policy for both fixtures. Cloudflare may add client transport compression after the Worker returns.

for p in gzip br; do
  curl -sS -D "/tmp/s1-$p.headers" -o "/tmp/s1-$p.html" "https://s1.thecompany-lab.com/$p"
  echo "--- /$p"
  grep -iE '^(HTTP|content-encoding|x-rs-transform-encoding|cache-control)' "/tmp/s1-$p.headers"
done