fix(security): swap script-src 'unsafe-inline' for a per-request CSP nonce

[MarkusNeusinger]

The open item #11213 left behind, closed the way that PR said it had to be: a nonce, not a hash.

Why a nonce is the only thing that can work here

app/index.html ships three executable inline scripts. A FOURTH arrives after nginx — Cloudflare JavaScript Detections injects one into every HTML response at the edge, and its body carries a per-response ray id and timestamp:

window.__CF$cv$params={r:'a35d48a2bdf1be85',t:'MTc4ODUyNzk0NA=='};…

A body that differs per response has no hash to list, which is what #11213 measured and why the hash policy was not shipped. Turning JavaScript Detections off is not available either: the Free plan rejects enable_js=false while Bot Fight Mode is on.

Verified against Cloudflare's current docs (JavaScript Detections, read 2026-09-04, and the bots reference page, last updated 2026-08-26):

"If your CSP uses a nonce for script tags, Cloudflare will add these nonces to the scripts it injects by parsing your CSP response header."

"We highly discourage the use of unsafe-inline and instead recommend the use CSP nonces in script tags which we parse and support in our CDN."

Two conditions come with it and both hold here: the nonce must arrive in the response header ("JavaScript Detections is not supported with nonce set via <meta> tags"), and /cdn-cgi/challenge-platform/ must be reachable — script-src 'self' covers it, same-origin. Two side effects the docs name are already true of this setup: JSD strips ETag from injected responses (we clear it anyway, below), and it skips injection entirely on Cache-Control: no-transform, which we do not send.

The mechanism

$request_id — nginx's own 16 random bytes rendered as 32 hex digits. Hex is a subset of the base64-value charset the CSP nonce grammar accepts, and 128 bits is at the ceiling of what the spec asks for.

• Header (app/security-headers.conf): script-src 'self' 'nonce-$request_id' https://cdn.jsdelivr.net. 'unsafe-inline' is gone, not kept beside it — a browser ignores it the moment a nonce appears, so the pair is the strict policy wearing a permissive label.
• Stamp (app/nginx.conf): sub_filter '<script' '<script nonce="$request_id"' with sub_filter_once off, at server level in both server blocks. Not per-location, because four locations can end up serving the shell — the exact = /index.html, the SPA fallback, and in the python.anyplot.ai block two regex routes whose try_files /index.html =404 serves the file in place, with no internal redirect to re-run location matching. A per-location stamp is a stamp missing from whichever one is forgotten, failing on those routes alone.
• Not precompressed (app/vite.config.ts): index.html is excluded from both compression plugins. gzip_static on would hand out index.html.gz byte for byte and sub_filter — which only ever sees uncompressed bodies — would silently skip the stamp while the header still demanded it. The hashed chunks keep their .gz/.br; the shell is 11 kB and nginx gzips it on the fly.
• Never replayed: every location that answers with the shell sends no-store — the exact = /index.html in each server block and the two python-host spec routes, which the review caught serving a nonced shell with no Cache-Control at all (see below) — and sub_filter clears Last-Modified and ETag on its own whenever it rewrites a body. Without that, a 304 would replace the stored headers with a fresh nonce while the stored body still carried the old one — the classic nonce-plus-cache failure. Verified below: neither validator is present.

'strict-dynamic' is deliberately not adopted. The reason is narrower than it first looks, and the review sharpened it: the keyword makes the browser ignore 'self' for scripts, but the entry module is itself a nonced <script>, so it runs and the imports it fetches run with it. What breaks is one layer up — yarn build links every chunk from the shell with <link rel="modulepreload">, and a link element is neither something trust propagation reaches nor something a <script-only stamp touches. Those hints are refused, which costs a console full of violations and a slower first paint, not a blank page. A cost with nothing bought, since the chunks are fingerprinted files under 'self' already. So the chunks stay on 'self', and a test requires the stamp to be widened to <link> by whoever adopts the keyword.

Local verification, behind the real config

nginx 1.24 with http_sub_module, running app/nginx.conf itself (only the include path, docroot and port rewritten) over a real yarn build:

req1 header nonce: nonce-0dc9d1209b7ed536aca2366495392bf0
req2 header nonce: nonce-c608aa902ce6cbe622e659f901c6f326   ← different per request

script tags total: 7, without a nonce: 0
distinct nonces in one response: 1; length: 32
header nonce == tag nonce:  MATCH

stamped tags, SPA fallback deep route: 7
stamped tags, exact /index.html:       7
stamped tags, vhost spec route:        7    ← the try_files-in-place path
stamped tags, vhost spec/library:      7
stamped tags, vhost reserved route:    7

/assets/index-*.js  content-encoding: gzip, nonce occurrences: 0   ← precompressed, untouched
shell with Accept-Encoding: gzip → still 7 stamped tags
etag/last-modified present: 0
index.html.gz / index.html.br in dist: absent; assets/*.gz: present

sub_filter comes from ngx_http_sub_module, which is not compiled in by default, so it is worth having checked rather than assumed: nginxinc/nginx-unprivileged:alpine installs the prebuilt nginx package from nginx.org's Alpine repository, and that binary's own configure line carries --with-http_sub_module (unpacked nginx-1.31.5-r1.apk and read the string out of usr/sbin/nginx). Had it been missing, nginx would have refused to start on "unknown directive" — caught by the candidate, but only there.

The one cosmetic finding on the way: sub_filter is a literal string match, so the HTML comment that documented the Eruda loader with the words Plain <script> came back carrying a stray nonce= inside a comment. Harmless, but confusing in exactly the artefact anyone debugging CSP reads, so the comment now describes the tag instead of spelling it.

Guards, so this cannot rot quietly

tests/unit/api/test_csp_policy.py — the hash test is retired with the hashes (they guarded a reserve that no longer exists), and six checks take its place. Every one was mutation-checked: each mutation below was applied to a copy and the named test was confirmed to fail.

Mutation	Caught by
stamp renamed to $connection	test_the_header_and_the_stamp_name_the_same_variable
sub_filter removed from the python server block	test_every_server_block_stamps_the_nonce
sub_filter_once off dropped	same
the vite exclude removed	test_the_shell_is_never_precompressed
'unsafe-inline' put back beside the nonce	test_script_src_never_mixes_unsafe_inline_with_a_nonce_or_hash
nonce frozen to a literal	test_the_policy_takes_its_nonce_from_a_per_request_variable
nonce dropped from the header	that one and the same-variable test
'strict-dynamic' added without widening the stamp	test_strict_dynamic_would_have_to_widen_the_stamp_to_the_module_preloads
no-store removed from the exact = /index.html	test_the_shell_is_never_stored
no-store removed from ONE python-host spec route	same
a python-host spec route reverted to a bare try_files	same

That exercise found a real defect in the first draft: header_nonce_variable() read the nonce with a regex over the whole conf file, and security-headers.conf quotes 'nonce-…' in its own prose — so with the nonce deleted from the actual directive the test still "found" one and passed. It now reads the parsed directive.

And the deploy smoke refuses to promote without it. app/cloudbuild.yaml now fetches the candidate's shell, pulls the nonce out of its Content-Security-Policy header, and requires that every <script> tag carries that exact value. This is the failure with no other symptom: the page still arrives, still has its <div id="root">, still passes every existing probe — and runs no inline script at all.

That probe was run four ways against local nginx, using the step's own bash with Cloud Build's $$ resolved. Against the config in this PR:

OK: all 7 script tags of the shell carry the header's nonce      exit 0

against the same config with the two sub_filter directives deleted:

0 of 7 <script> tag(s) carry the header's nonce-0cfb5ee4…        exit 1

against a config that stamps a different variable than the header — the case review round one showed the probe waving through, because it counted nonce= attributes instead of comparing them:

0 of 7 <script> tag(s) carry the header's nonce-2a28032d…        exit 1

and with an index.html.gz planted back into the docroot, which is round two's finding and the one that mattered most: plain curl sends no Accept-Encoding, so gzip_static never reaches for the .gz and the probe was blind to the exact regression it exists for.

plain curl         7 stamped tags   → passed
curl --compressed  0 stamped tags   → what a browser gets

With --compressed on that fetch it fails on the planted file (0 of 7 … nonce-ffb48a58…, exit 1) and passes once the .gz is gone.

Rollback

Under a minute, no rebuild, back to today's policy byte for byte:

gcloud run revisions list --service anyplot-app --region europe-west4 \
  --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 10

gcloud run services update-traffic anyplot-app --region europe-west4 \
  --to-revisions=<chosen-revision>=100

Pick the target by creation time, not by position — "the previous revision" is the pre-nonce one only until the next frontend deploy, which the review flagged. Once no pre-nonce revision is left, the lever is a revert PR through the normal pipeline; acceptable, because by then the live question has long been answered. Written down in agentic/docs/project-guide.md § Rollback and, in short form, at the directive it protects in app/security-headers.conf.

A Cloud Run env var switch was considered and deliberately not built, and that is a deviation from the brief worth stating plainly. nginx cannot read the process environment from its configuration, so an env-var switch needs a startup templating step — envsubst into a writable path, and /etc/nginx is read-only in nginxinc/nginx-unprivileged (checked: no chown/chmod g+w on it, final USER 101), so the image's own NGINX_ENVSUBST_OUTPUT_DIR mechanism bails out with "not writable" and renders nothing. The alternative is a hand-rolled entrypoint writing config into /tmp. Either way its failure mode is "the container does not start", and there is no Docker in this environment and no CI job that builds this image, so nothing could exercise it before it mattered. The traffic split has the same latency, needs no new machinery, and the deploy pipeline proves the previous revision healthy on every build.

What must still be measured in production, and what it would mean

Whether Cloudflare actually stamps the nonce is not observable from here — it depends on the CSP header the edge sees from the origin, so a local proxy cannot fake it. After merge and deploy, on https://anyplot.ai in a real browser: the JSD script present and carrying the nonce, zero CSP violations on the landing page and a plot page, Plausible events still firing, Bot Fight Mode still active.

One thing to look for specifically. The injected script creates a hidden about:blank iframe and inserts a second inline script into that document:

var d=b.createElement('script');
d.innerHTML="window.__CF$cv$params={…};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';…";

An about:blank document inherits its embedder's CSP, so that inner script needs the nonce too — and there is an open Cloudflare community report that JSD does not propagate the nonce into that frame. If the outer script is nonced and only the inner one is refused, that is an upstream gap in a defence-in-depth signal and not a site regression; if the outer script is refused too, Cloudflare is not honouring the nonce at all, and the rollback above is the answer.

Review rounds

Six rounds. Twelve findings taken, one rejected with sources, the last round clean (0 comments, 0 open threads).

• Round 1 (5): the no-store gap below; the smoke counting nonce= instead of comparing it; the rollback's positional "previous revision"; anyplot-backend → anyplot-api; and the 128-bit overstatement.
• Round 2 (2): the deploy probe did not ask for compression, so gzip_static never reached for a .gz and it could not see the precompressed-shell regression it exists for — the sharpest catch of the six, reproduced above. Plus the rollback as a numbered procedure per the repository's Google style.
• Round 3 (1 taken, 1 rejected): the entropy wording repeated in the test. Rejected, with sources: that a nonce cannot authorize a <link rel="modulepreload"> — see the comment thread; four frameworks ship precisely that fix.
• Round 4 (2): nonce-[0-9a-f]* accepted a bare nonce- that test -n calls non-empty, so an empty nonce would have agreed with nonce="" tags all the way through; and the precompression guard now RUNS the declared pattern against index.html instead of reading it for the word "index", after three near-misses in two rounds showed the reading approach was the wrong shape.
• Round 5 (2): test_every_server_block_stamps_the_nonce searched the whole block, nested locations included — so moving the stamp into location = /index.html would have satisfied the guard that exists to refuse exactly that, and the smoke wouldn't have caught it either since it probes / on the main host. It now cuts nested locations out first. Plus "two extra curls" where the probe adds one.
• Round 6: clean.

The one worth naming in full is round one's, a genuine hole the local probes had walked straight past: python.anyplot.ai/<spec> and /<spec>/<library> serve the shell through try_files /index.html =404, which treats the shell as a FILE and answers inside that location — no internal redirect, so location = /index.html and its no-store are never reached. Measured before the fix:

$ curl -sI -H "Host: python.anyplot.ai" .../scatter-basic | grep -i cache-control
(nothing)
$ curl -sI .../scatter-basic | grep -i cache-control
Cache-Control: no-cache, no-store, must-revalidate

A nonced shell a client may keep. Both routes now send the shell's Cache-Control and re-include security-headers.conf beside it (an add_header of their own would otherwise have dropped the entire inherited set — verified CSP, HSTS and X-Frame-Options are still on those responses). And the test no longer looks for location = /index.html by name: it derives the shell locations from the try_files argument positions, finds all four, and fails if any one loses no-store.

Verification: pytest tests/unit tests/integration — 1974 passed. ruff check, ruff format --check, mypy api core clean. yarn type-check, yarn lint, yarn fm:check clean, yarn test — 626 passed in 70 files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🟡 Changes recommended

Some shell routes remain cacheable, and several safeguards and rollback instructions do not enforce their stated guarantees.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Replaces inline-script CSP allowances with per-request nginx nonces and adds deployment safeguards.

Changes:

• Stamps CSP nonces onto shell scripts and prevents precompressed shell delivery.
• Adds policy regression tests and deployment smoke checks.
• Documents deployment rollback procedures.

File summaries

File	Description
app/nginx.conf	Stamps per-request nonces.
app/security-headers.conf	Enforces nonce-based CSP.
app/vite.config.ts	Excludes the shell from precompression.
app/cloudbuild.yaml	Adds nonce deployment checks.
app/index.html	Adjusts a nonce-sensitive comment.
tests/unit/api/test_csp_policy.py	Adds CSP configuration guards.
agentic/docs/project-guide.md	Documents rollback procedures.
changelog.d/csp-nonce.md	Records the security change.

Review details

Suppressed comments (2)

tests/unit/api/test_csp_policy.py:260

• This guard encodes the wrong failure mode. Vite's external module entry is itself a <script> and receives the nonce, so it remains trusted under 'strict-dynamic'; if a modulepreload hint is refused, the entry still executes and fetches its imports later, causing a performance regression rather than a blank SPA. Requiring an arbitrary <link substitution would reject a valid policy and does not prove the preload is authorized; remove or rework this guard and the matching policy explanation.

    assert re.search(r"sub_filter\s+'<link", conf), (
        "script-src carries 'strict-dynamic', which drops 'self' for scripts, but "
        "app/nginx.conf still stamps only <script> tags. Vite's <link "
        'rel="modulepreload"> chunk hints would be blocked and the SPA would never '

agentic/docs/project-guide.md:1088

• This rollback guarantee expires after the next frontend deployment: at that point the previous revision also serves the nonce policy, not 'unsafe-inline'. The procedure should identify a recorded pre-nonce revision or another durable known-good target rather than assuming the immediately previous revision always predates this change.

image and only reveals itself in production. The current example is the CSP nonce path in
`app/security-headers.conf`: if Cloudflare ever stops stamping its edge-injected script
with the nonce it reads from our response header, the previous revision still serves the
`'unsafe-inline'` policy byte for byte.

• Files reviewed: 8/8 changed files
• Comments generated: 5
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The deployment probe does not request compression, so it cannot detect the precompressed-shell failure it claims to prevent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The strict-dynamic guard incorrectly treats nonce-stamped modulepreload links as CSP-authorized.

Review details

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

app/security-headers.conf:85

• The proposed remediation does not work: CSP nonce matching does not authorize <link rel="modulepreload">, and 'strict-dynamic' trust propagation applies to scripts created by a trusted script, not parser-created link elements. Widening sub_filter to <link> would therefore still leave these preload requests blocked; document a tested redesign or removal of the preload hints instead.
  tests/unit/api/test_csp_policy.py:174
• This repeats the entropy overstatement already corrected in security-headers.conf: CSP recommends at least 128 bits; it does not define 128 bits as a ceiling. Keep the test rationale consistent with the policy documentation.

This issue also appears on line 302 of the same file.

tests/unit/api/test_csp_policy.py:306

• This assertion codifies the same ineffective fix: it passes when any <link> stamp exists, although nonce attributes do not authorize modulepreload links under CSP. Reject 'strict-dynamic' while Vite emits parser-created modulepreloads, or test a proven preload-policy redesign instead.

    assert re.search(r"sub_filter\s+'<link", conf), (
        "script-src carries 'strict-dynamic', which drops 'self' for scripts, but "
        "app/nginx.conf still stamps only <script> tags — so Vite's <link "
        'rel="modulepreload"> chunk hints are refused and every chunk waits for the '
        "entry module to ask for it. Stamp <link> too, or drop the keyword."

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[MarkusNeusinger]

Round three left no threads, and its three suppressed notes split two ways. 256b2828 handles both.

Taken — the entropy wording. test_csp_policy.py still said "128 bits is at the ceiling of what the spec asks for" after security-headers.conf had already been corrected. CSP recommends at least 128 bits; both places now say that in the same words, so the two cannot drift again.

Not taken — "a nonce does not authorize <link rel=\"modulepreload\">". This one is wrong, and it is worth writing down rather than quietly working around, because it would have sent the next person to delete a guard that is correct.

A preload request carries its link element's nonce as the request's cryptographic nonce metadata, and a nonce-source in script-src matches against exactly that. The practical evidence is that four major frameworks each filed the same bug and each shipped the same fix — put the nonce on the preload link:

• React #26781 — auto-inserted <link rel="preload" as="script"> not nonced, blocked in Chrome under a nonce CSP
• Next.js #64091 — "Next does not add nonce to link rel=\"preload\" tag"
• Vite #9719 — nonce in __vitePreload
• Rails #53794 — "Add CSP nonce to preload links", merged
• Chromium 41308002 — the same, from the engine side

If the nonce did nothing for preload links, none of those fixes would work. So widening the sub_filter to <link> is the remedy, the guard stands as written, and both security-headers.conf and the test docstring now cite this so it does not have to be re-litigated.

Nothing about the shipped policy changes either way — 'strict-dynamic' is absent, and this guard only speaks to whoever adds it.

State: all checks green on every round, all seven review threads replied to and resolved, no open threads. Ready when you are.

[Copilot]

🔵 Needs a closer look

It changes enforced CSP and production deployment behavior, and the precompression test remains overly permissive.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

tests/unit/api/test_csp_policy.py:250

• This guard only checks whether the text after exclude contains index, so patterns such as /index\.js$/ or /not-index\.html$/ still pass even though Vite would emit index.html.gz. Match the actual index.html exclusion (or inspect the built outputs) so the test enforces the invariant it documents.
  agentic/docs/project-guide.md:1101
• Repository prose follows the Google style rules referenced by .github/copilot-instructions.md:10, which prohibit all-caps emphasis. Use sentence case here instead of NOT.

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The precompression test and deployment nonce probe both permit false-positive validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The edge-dependent security rollout needs human validation, and its server-scope regression guard remains incomplete.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

tests/unit/api/test_csp_policy.py:231

• This does not actually enforce server-level placement: each full server block also contains nested location includes, so moving the stamp into only location = /index.html still satisfies both searches while the Python in-place shell routes remain unstamped. Restrict the assertions to top-level server directives so this regression cannot pass the unit test (the deploy smoke only probes the main / route).
  changelog.d/csp-nonce.md:23
• This change adds one additional curl invocation—the existing shell probe was already present—so “two extra curls” overstates the deploy cost recorded in the changelog.

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The security-sensitive delivery change depends on Cloudflare’s production-only nonce injection behavior and requires final live verification.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Balanced