CSP docs: recommend a 256-bit nonce

This change should have no code impact.

We previously used a 128-bit nonce. This was probably fine, but more
entropy should further protect folks.

README.md

@@ -103,10 +103,10 @@ app.use(
 
 ```js
 // Sets the `script-src` directive to
-// "'self' 'nonce-e33ccde670f149c1789b1e1e113b0916'"
+// "'self' 'nonce-e33cc...'"
 // (or similar)
 app.use((req, res, next) => {
-  res.locals.cspNonce = crypto.randomBytes(16).toString("hex");
+  res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
   next();
 });
 app.use(

middlewares/content-security-policy/README.md

@@ -58,7 +58,7 @@ const crypto = require("crypto");
 const contentSecurityPolicy = require("helmet-csp");
 
 app.use((req, res, next) => {
-  res.locals.nonce = crypto.randomBytes(16).toString("hex");
+  res.locals.nonce = crypto.randomBytes(32).toString("hex");
   next();
 });