Our Project is built upon Spring MVC and JSP based application
One of the security tool throwed a CSP Vulnerability for inline script in our JSP files as below
Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-abc123'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Possible solutions suggested are There's a couple of options: • (Recommended) Move javascript into its own file • Switch to Report-Only and use a report-uri service - deprecated and doesnot suit the product Hash / Nonce
Tried with all the 3 ways,
- Report only is deprecated and wont be suitable for our project
- Moving the Javascript and style tags to multiple files is a time consuming activity
- Nonce – Working in a few browsers, it doesn’t have consistency with multiple browsers.
- Hash Technique – as we have multiple inline scripts, creating and maintaining hash code would create a clutter.
Please help me with any other solution.