mikewest/artur-yes

artur-yes's Issues

Nonce problems caused by multiple Arturs and CSPs

When having multiple Artur headers then these are practically two different 'strict-dynamic'-based CSPs. This means a script needs to have multiple nonces set to run (one from each policy).
The same situation occurs when CSP policie(s) is/are defined in parallel.

Potential solutions:

1. only one single Artur header is allowed.
2. as in 1) but in case a CSP policy uses Artur features (that is 'strict-dynamic') it overwrites the CSP's script-src directive
3. as in 1) but in case a CSP policy uses Artur features (that is 'strict-dynamic') it adds the Artur header's nonces to the script-src directive

The header’s value is interpreted as an array of JSON objects [...]

This is the same as having multiple Artur headers. But to allow different nonces Artur should be changed to expect a list of nonces instead, for example:
Artur: { "nonce": [ "abcdefg", "zxcvbn" ], "report": "group1" }