I'm working on a project where I have a content security policy enabled that only allows inline scripts with a nonce to be executed.
header("Content-Security-Policy: script-src 'nonce-".$nonce."';");
and so on the page my script tags have the nonce inserted in them as such:
<script nonce="<?php echo $nonce; ?>" src="/static/js/global.js"></script>
This works perfectly fine for the most part, but my site also loads the page using an ajax request and some of the pages that are loaded via ajax requests also have script tags in them as such.
<script nonce="<?php echo $nonce; //the same nonce as before ?>"></script>
The nonce is generated and stored on a session basis so each of the script tags in the ajax request should have the same nonce as the original page, but for some reason I get this error in the chrome console:
jquery.min.js:2
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-YTQ4NTU4NzU1YTlkZGY5MmYzNDZlMTc0MDRhNGNiZTk='". Either the 'unsafe-inline' keyword, a hash ('sha256-88nUYsb1c+aRY8mvRZ5hGPAkvH3REgfxFMQa6iIP4GY='), or a nonce ('nonce-...') is required to enable inline execution.
How do I make it so that the script tags loaded via the ajax request also get executed.
eval()
?