Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

How to set nonce in helmet >4.0?

See original GitHub issue

In version 3 I could set nonce from res.locals like this:

...
        scriptSrc: [
          (req, res) => `'nonce-${res.locals.nonce}'`,
          "'strict-dynamic'",
...

In 4.0 I get an error when providing a function for setting nonce:

Error: Content-Security-Policy received an invalid directive value for "script-src"

So the question is how to set nonce in helmet 4.0 ?

Issue Analytics

State:
Created 3 years ago
Reactions:3
Comments:6 (3 by maintainers)

Top GitHub Comments

5reactions

EvanHahncommented, Aug 6, 2020

@mercteil That’s exactly right. Here’s a wiki page describing how to do that in more detail.

@einfallstoll Good point. I’ve added it to the changelog in c01ad1e37c964df0108c37da4dd32af4630df95e.

This has made me realize that I need to create a migration guide. See #241 to track this.

I’m going to close this issue because I think this has been resolved, but if folks really want this feature, we can discuss adding it back.

1reaction

XhmikosRcommented, Aug 9, 2020

Agreed that this was pretty handy and simpler than the current solution. I haven’t updated to helmet 4.0.0 due to this issue, so if it’s not too much work, I’d like the ability to use functions back too 🙂

Top Results From Across the Web

Helmet and contentSecurityPolicy and using nonce AND ...

I am a newbie here but I noticed that in your error: Refused to load the script '<URL>' because it violates the following...

Setting up Content Security Policy with JSS

In the server startup, we'll add middleware to generate the nonce. // server.js import helmet from 'helmet' import uuidv4 from 'uuid/v4' import express...

How to use the helmet.contentSecurityPolicy function in helmet

To help you get started, we've selected a few helmet. ... nonceGenerator(req, res, next) { res.locals.nonce = uuid.v4(); next(); }); /* eslint-disable ...

helmet - npm

First, run npm install helmet for your app. Then, in an Express app: const express = require("express"); const helmet = require("helmet"); ...

Helmet-csp NPM

helmet -csp v3.4.0. Install. Weekly downloads. 875,808. License. MIT. Repository. github. Last release. 2 years ago. Share icon Share package ...