Strict CSP: nonce or hash? Choose based on how your application ships scripts addresses one concrete problem: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. The guide works from the actual objects — CSP, nonce, hash, strict-dynamic, script — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: CSP meets nonce
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c11 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. If the CSP verification fails, rollback restores the configuration around nonce, replays strict-csp-nonce-vs-hash-c11, and compares the new state with the control evidence from hash. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to strict-dynamic, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by script and nonce: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c11 is labeled as a limitation or inference, never promoted to fact.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c12 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns strict-dynamic into a reviewable decision point with a named input and a retained output. To test script, fixture strict-csp-nonce-vs-hash-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to CSP. Operations then observes the transition between CSP and nonce, while security checks that hash receives neither implicit authority nor unnecessary data.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c13 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. If the hash verification fails, rollback restores the configuration around strict-dynamic, replays strict-csp-nonce-vs-hash-c13, and compares the new state with the control evidence from script. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to CSP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by nonce and strict-dynamic: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c13 is labeled as a limitation or inference, never promoted to fact.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c14 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns CSP into a reviewable decision point with a named input and a retained output. To test nonce, fixture strict-csp-nonce-vs-hash-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to hash. Operations then observes the transition between hash and strict-dynamic, while security checks that script receives neither implicit authority nor unnecessary data.
Failure modes, signals, and diagnosis
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c21 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. Operations then observes the transition between CSP and nonce, while security checks that hash receives neither implicit authority nor unnecessary data. If the nonce verification fails, rollback restores the configuration around hash, replays strict-csp-nonce-vs-hash-c21, and compares the new state with the control evidence from strict-dynamic. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to script, a concrete condition, and evidence instead of a generic assurance.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c22 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. The conclusion stays bounded by nonce and strict-dynamic: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c22 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns script into a reviewable decision point with a named input and a retained output. To test CSP, fixture strict-csp-nonce-vs-hash-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to nonce.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c23 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. Operations then observes the transition between hash and strict-dynamic, while security checks that script receives neither implicit authority nor unnecessary data. If the strict-dynamic verification fails, rollback restores the configuration around script, replays strict-csp-nonce-vs-hash-c23, and compares the new state with the control evidence from CSP. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to nonce, a concrete condition, and evidence instead of a generic assurance.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c24 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. The conclusion stays bounded by strict-dynamic and CSP: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c24 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns nonce into a reviewable decision point with a named input and a retained output. To test hash, fixture strict-csp-nonce-vs-hash-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to strict-dynamic.
Progressive rollout and rollback
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c31 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. To test CSP, fixture strict-csp-nonce-vs-hash-c31 contains both an allowed state and a rejected state; rejection must occur before any change attributed to nonce. Operations then observes the transition between nonce and hash, while security checks that strict-dynamic receives neither implicit authority nor unnecessary data. If the hash verification fails, rollback restores the configuration around strict-dynamic, replays strict-csp-nonce-vs-hash-c31, and compares the new state with the control evidence from script.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c32 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to nonce, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by hash and script: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c32 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns CSP into a reviewable decision point with a named input and a retained output.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c33 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. To test hash, fixture strict-csp-nonce-vs-hash-c33 contains both an allowed state and a rejected state; rejection must occur before any change attributed to strict-dynamic. Operations then observes the transition between strict-dynamic and script, while security checks that CSP receives neither implicit authority nor unnecessary data. If the script verification fails, rollback restores the configuration around CSP, replays strict-csp-nonce-vs-hash-c33, and compares the new state with the control evidence from nonce.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c34 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to strict-dynamic, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by script and nonce: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c34 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns hash into a reviewable decision point with a named input and a retained output.
Production decision criteria
The starting point is not a feature; it is an observable decision boundary.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c41 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns CSP into a reviewable decision point with a named input and a retained output. To test nonce, fixture strict-csp-nonce-vs-hash-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to hash. Operations then observes the transition between hash and strict-dynamic, while security checks that script receives neither implicit authority nor unnecessary data.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c42 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. If the script verification fails, rollback restores the configuration around CSP, replays strict-csp-nonce-vs-hash-c42, and compares the new state with the control evidence from nonce. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to hash, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by strict-dynamic and CSP: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c42 is labeled as a limitation or inference, never promoted to fact.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c43 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns hash into a reviewable decision point with a named input and a retained output. To test strict-dynamic, fixture strict-csp-nonce-vs-hash-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to script. Operations then observes the transition between script and CSP, while security checks that nonce receives neither implicit authority nor unnecessary data.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c44 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. If the nonce verification fails, rollback restores the configuration around hash, replays strict-csp-nonce-vs-hash-c44, and compares the new state with the control evidence from strict-dynamic. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to script, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by CSP and hash: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c44 is labeled as a limitation or inference, never promoted to fact.
Trust boundaries around hash
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c51 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. The conclusion stays bounded by strict-dynamic and CSP: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c51 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns nonce into a reviewable decision point with a named input and a retained output. To test hash, fixture strict-csp-nonce-vs-hash-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to strict-dynamic.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c52 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. Operations then observes the transition between script and CSP, while security checks that nonce receives neither implicit authority nor unnecessary data. If the CSP verification fails, rollback restores the configuration around nonce, replays strict-csp-nonce-vs-hash-c52, and compares the new state with the control evidence from hash. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to strict-dynamic, a concrete condition, and evidence instead of a generic assurance.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c53 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. The conclusion stays bounded by CSP and hash: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c53 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns strict-dynamic into a reviewable decision point with a named input and a retained output. To test script, fixture strict-csp-nonce-vs-hash-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to CSP.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c54 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. Operations then observes the transition between nonce and hash, while security checks that strict-dynamic receives neither implicit authority nor unnecessary data. If the hash verification fails, rollback restores the configuration around strict-dynamic, replays strict-csp-nonce-vs-hash-c54, and compares the new state with the control evidence from script. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to CSP, a concrete condition, and evidence instead of a generic assurance.
Compare CSP and nonce on common criteria
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c61 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to strict-dynamic, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by script and nonce: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c61 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns hash into a reviewable decision point with a named input and a retained output.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c62 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. To test script, fixture strict-csp-nonce-vs-hash-c62 contains both an allowed state and a rejected state; rejection must occur before any change attributed to CSP. Operations then observes the transition between CSP and nonce, while security checks that hash receives neither implicit authority nor unnecessary data. If the nonce verification fails, rollback restores the configuration around hash, replays strict-csp-nonce-vs-hash-c62, and compares the new state with the control evidence from strict-dynamic.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c63 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to CSP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by nonce and strict-dynamic: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c63 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns script into a reviewable decision point with a named input and a retained output.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c64 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. To test nonce, fixture strict-csp-nonce-vs-hash-c64 contains both an allowed state and a rejected state; rejection must occur before any change attributed to hash. Operations then observes the transition between hash and strict-dynamic, while security checks that script receives neither implicit authority nor unnecessary data. If the strict-dynamic verification fails, rollback restores the configuration around script, replays strict-csp-nonce-vs-hash-c64, and compares the new state with the control evidence from CSP.
When the opposite choice becomes rational
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c71 starts at strict-dynamic and treats script as an explicit boundary rather than an implicit assumption. The first control requires CSP to emit an observable result before nonce can trigger the intended effect around hash. If the nonce verification fails, rollback restores the configuration around hash, replays strict-csp-nonce-vs-hash-c71, and compares the new state with the control evidence from strict-dynamic. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to script, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by CSP and hash: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c71 is labeled as a limitation or inference, never promoted to fact.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c72 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns script into a reviewable decision point with a named input and a retained output. To test CSP, fixture strict-csp-nonce-vs-hash-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to nonce. Operations then observes the transition between nonce and hash, while security checks that strict-dynamic receives neither implicit authority nor unnecessary data.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c73 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. If the strict-dynamic verification fails, rollback restores the configuration around script, replays strict-csp-nonce-vs-hash-c73, and compares the new state with the control evidence from CSP. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to nonce, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by hash and script: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c73 is labeled as a limitation or inference, never promoted to fact.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c74 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns nonce into a reviewable decision point with a named input and a retained output. To test hash, fixture strict-csp-nonce-vs-hash-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to strict-dynamic. Operations then observes the transition between strict-dynamic and script, while security checks that CSP receives neither implicit authority nor unnecessary data.
Evidence point: OpenAI documents that mCP integrations can expose remote or local tools; the documentation recommends trusted servers, least-privilege credentials and approvals for sensitive operations. This source anchors when the opposite choice becomes rational but does not replace local verification. [S7]Controls that remain after launch
The starting point is not a feature; it is an observable decision boundary.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c81 starts at script and treats CSP as an explicit boundary rather than an implicit assumption. The first control requires nonce to emit an observable result before hash can trigger the intended effect around strict-dynamic. Operations then observes the transition between nonce and hash, while security checks that strict-dynamic receives neither implicit authority nor unnecessary data. If the hash verification fails, rollback restores the configuration around strict-dynamic, replays strict-csp-nonce-vs-hash-c81, and compares the new state with the control evidence from script. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to CSP, a concrete condition, and evidence instead of a generic assurance.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c82 starts at CSP and treats nonce as an explicit boundary rather than an implicit assumption. The first control requires hash to emit an observable result before strict-dynamic can trigger the intended effect around script. The conclusion stays bounded by hash and script: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c82 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns CSP into a reviewable decision point with a named input and a retained output. To test nonce, fixture strict-csp-nonce-vs-hash-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to hash.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c83 starts at nonce and treats hash as an explicit boundary rather than an implicit assumption. The first control requires strict-dynamic to emit an observable result before script can trigger the intended effect around CSP. Operations then observes the transition between strict-dynamic and script, while security checks that CSP receives neither implicit authority nor unnecessary data. If the script verification fails, rollback restores the configuration around CSP, replays strict-csp-nonce-vs-hash-c83, and compares the new state with the control evidence from nonce. This detail makes “Strict CSP: nonce or hash? Choose based on how your application ships scripts” reviewable because each operational statement points to hash, a concrete condition, and evidence instead of a generic assurance.
In “Strict CSP: nonce or hash? Choose based on how your application ships scripts”, scenario strict-csp-nonce-vs-hash-c84 starts at hash and treats strict-dynamic as an explicit boundary rather than an implicit assumption. The first control requires script to emit an observable result before CSP can trigger the intended effect around nonce. The conclusion stays bounded by script and nonce: anything not demonstrated by scenario strict-csp-nonce-vs-hash-c84 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Select nonce-based or hash-based strict CSP by deployment model, caching behavior and script generation. It turns hash into a reviewable decision point with a named input and a retained output. To test strict-dynamic, fixture strict-csp-nonce-vs-hash-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to script.
Evidence point: OpenAI documents that encryptedSession can wrap a session store with Fernet encryption, per-session HKDF-derived keys and TTL-based expiration. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around CSP has an input, a rule, a rejection behavior, and evidence.
- The control around nonce has an input, a rule, a rejection behavior, and evidence.
- The control around hash has an input, a rule, a rejection behavior, and evidence.
- The control around strict-dynamic has an input, a rule, a rejection behavior, and evidence.
- The control around script has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] Content-Security-Policy: require-trusted-types-for directive — require-trusted-types-for can make DOM XSS sinks reject raw strings and accept trusted typed values instead. source
- [S2] Content Security Policy Cheat Sheet — OWASP recommends strict CSP designs based on nonces or hashes instead of large static allowlists. source
- [S3] Application Security Checklist - Kubernetes — Kubernetes application guidance covers secure workload practices from the developer perspective. source
- [S4] Content Security Policy (CSP) - MDN — CSP can reduce script-injection risk, and Trusted Types can constrain dangerous DOM injection sinks to typed values created by approved policies. source
- [S5] Content-Security-Policy: trusted-types directive — The trusted-types CSP directive allowlists policy names and became broadly available across current browsers in 2026. source
- [S6] Guardrails - OpenAI Agents SDK — Agent and tool guardrails can validate inputs or outputs and can stop execution with tripwire-style failures. source
- [S7] Model context protocol (MCP) - OpenAI Agents SDK — MCP integrations can expose remote or local tools; the documentation recommends trusted servers, least-privilege credentials and approvals for sensitive operations. source
- [S8] Encrypted session - OpenAI Agents SDK — EncryptedSession can wrap a session store with Fernet encryption, per-session HKDF-derived keys and TTL-based expiration. source
- [S9] Results - OpenAI Agents SDK — Run results expose final output, new items, agent identity, raw responses, guardrail results, state and usage diagnostics. source
- [S10] Authorization - Model Context Protocol — For HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. source
Comments
No published comment yet.
Sign in to comment