Configure Content Security Policy (CSP) with nonces
mainTo support strict CSP, you must generate a unique nonce per request.
- Generate a nonce (e.g., using
nanoid). - Pass the nonce to
registry.styles({ nonce }). - Set a
<meta property="csp-nonce" content={nonce} />tag in your HTML. - Ensure your
Content-Security-Policyheader includes the same nonce in thestyle-srcdirective.
import nanoid from 'nanoid'
const nonce = Buffer.from(nanoid()).toString('base64') //ex: N2M0MDhkN2EtMmRkYi00MTExLWFhM2YtNDhkNTc4NGJhMjA3