web-security

1 piece

• A Nonce Is Not a Security Upgrade If Your Pages Are Static

  How a textbook-perfect Content-Security-Policy shipped a site with every script blocked, while every gate stayed green

  Tightening script-src to a per-request nonce is standard hardening advice. On a statically prerendered Next.js site it silently disables all JavaScript on every static route, and nothing in the build, the test suite or the response headers will tell you.

  2026-09-07 · technical-essay · 5 min read