CSP problem

[soilssong]

CSP problem

[wizzymore]

Can you provide a snippet of the code that triggers this error?

[soilssong]

Can you provide a snippet of the code that triggers this error?

Actually I'm adding my scripts like that due to BundleConfig.
I have tried to adding nonce to every script that related the Jquery but the result is same, I even tried to hard coded nonce like

<script ............ 'nonce-example' There are lot of script file that uses Jquery so I'm not quite sure which one is triggering and is that the proper usage of nonce values.

[wenz]

Looking at the error message in the browser console, it looks like there is no nonce in the CSP.

[soilssong]

Yes that was the error message before I have applied nonce. I added hard-coded nonce like below even I know that its should be generated at each request but just wanted to test it with static value.

This is my CSP:

in that CSP condition isn't that enough to add this value to script tags as a nonce value that related to Jquery ?

[wenz]

Thanks for the clarification. I assume you could confirm in the browser dev tools that the <script> tag in question does not have a nonce attribute, right? A minimal reproduction of the error, e.g. on jsbin, would be helpful.

[mgol]

The browser will generally clean the nonce attribute for security reasons but you should be able to read the nonce property - you can even try doing that from browser DevTools.

It's hard to act on this without any test case. Hence the Needs info label for now.

[soilssong]

First of all sorry for late response and thanks for your support.
I can confirm that in web browser tool , I can see the nonce attribute but its hides the value of it. ( and I think as mgol said its a built in behavior by modern browsers)
Beside of all these recently I have realised that even my onClick functions are violating CSP itself. You can see it below.
There are lot of functions so I couldn't figure out how can I minimize it and just wanted to show some part of it.
For example this is the codes I'm using from pagination, when I'm clicking the any page number new CSP violation error occurs.

[mgol]

Inline event handlers will definitely conflict with CSP. It looks like you have a lot to do that’s unrelated to jQuery. Let me close the issue then. You may want to try venues more geared towards developer help rather than the jQuery bug report.