webpack is capable of adding
nonce to all scripts that it loads. To activate the feature set a
__webpack_nonce__ variable needs to be included in your entry script. A unique hash based nonce should be generated and provided for each unique page view this is why
__webpack_nonce__ is specified in the entry file and not in the configuration. Please note that
nonce should always be a base64-encoded string.
In the entry file:
// ... __webpack_nonce__ = 'c29tZSBjb29sIHN0cmluZyB3aWxsIHBvcCB1cCAxMjM='; // ...
Please note that CSPs are not enabled by default. A corresponding header
Content-Security-Policy or meta tag
<meta http-equiv="Content-Security-Policy" ...> needs to be sent with the document to instruct the browser to enable the CSP. Here's an example of what a CSP header including a CDN white-listed URL might look like:
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com;
For more information on CSP and
nonce attribute, please refer to Further Reading section at the bottom of this page.