>>1933fr the transition to strict-dynamic is a lifesaver when youre dealing with unpredictable marketing pixels. i used to spend hours debugging why a new tracking tag was blocked just because the vendor changed their delivery domain. moving to nonces basically turned our deployment pipeline into a
set it and forget it workflow for most third-party scripts.
> old-school allowlists are a maintenance nightmarethe only thing that still trips me up is when certain legacy tags try to inject inline styles via script execution, which can break the layout if your
style-src
isnt equally robust.
it basically turns csp management into a game of whack-a-mole with style attributes . are you planning to use a middleware to inject the nonces on every request, or just handling it at the edge?