CSP Strategy SOP: Nonce vs Hash

CSP Strategy SOP: Nonce vs Hash
Locking down inline scripts with Content-Security-Policy. Choose by how your scripts are served.

— Use nonces when: pages are server-rendered and you can inject a fresh random value per request. Works for dynamic inline blocks.
— Use hashes when: content is static/cached (CDN, static site) where a per-request nonce can't change. Hash the exact script body.
— Never use 'unsafe-inline' with either: it cancels both. The browser ignores nonces/hashes when unsafe-inline is present in CSP2 fallback.
— Add 'strict-dynamic' so trusted scripts can load their own children without whitelisting every CDN.
— Verify: open DevTools console, confirm zero CSP violation reports on real traffic before enforcing.

Run this when you ship a new CSP.