Skip to main content

33. CSP Bypass Notes: nonces, strict-dynamic, and Mistakes

CSP reduces XSS, but configuration mistakes immediately become bypass opportunities. These are only the key patterns that also appear frequently in CTFs.

Common bypass points​

  • Nonce reuse: if a template cache reuses the same nonce, an attacker can inject a script
  • Misunderstanding strict-dynamic: scripts dynamically loaded by a trusted script are also allowed
  • Mixing unsafe-inline + nonce: when both are present, inline scripts are effectively allowed
  • JSONP/assignment-style scripts: JSONP in the form callback= provides a CSP bypass path

Quick inspection checklist​

  • Check whether the nonce changes with every response
  • Check whether script-src contains a wildcard
  • Check whether third-party scripts perform dynamic loading

The heart of the defense is "always use a fresh nonce, and keep the policy least-privileged." CSP fails through operational habits more often than through the rules themselves.