I have this CSP header:
Content-Security-Policy: default-src 'self'; script-src 'nonce-someNonce' 'strict-dynamic'; style-src 'nonce-someNonce' 'strict-dynamic'; font-src 'self' https://fonts.gstatic.com; object-src 'none'; img-src 'self' https://www.google-analytics.com; block-all-mixed-content;
Which aside from needing to lose the static urls and be backward compatible, has a problem. The site this will protect has a number of js library dependencies. However while strict-dynamic is being set, trust does not appear to be propogating to <style>
and <script>
tags subsequently created by the root trusted js files, or to subsequent css/js files loaded by the trusted roots. Note that these nested tags and files do not have any kind of nonce attribute, which might well be the problem, although my understanding is that only the root needs it.
Anyone see the problem with my policy?