I'm adding a Content Security Policy to existing code base - before trying to trawl through all the code and moving the js and styles into own files I want to try adding nonce values to inline scripts and styles to address the issue.
The problem I seem to be facing is - even when adding nonce values it will complain:
[Report Only] Refused to apply inline style because it violates the following Content Security Policy directive: "style-src * 'nonce-S3K4N+WzsYrM+TsiW35/HlSPjj1YlFZibtF7hFvUu+w='". Either the 'unsafe-inline' keyword, a hash ('sha256-A/b3IVVom/pPLN8iVEuiqcxE3cwDa6K8wPYTpcTqGTU='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Be it inline styles or a simple script open tag it will complain. Any ideas??
Thanks