Hability to configure request-specific nonce on CSP

[gtramontina]

Hey there. First of all, thank you for this port!

I've been looking for ways of configuring CSP directives to include nonces, like we can in the express version:

directives: {
  scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
  styleSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
},

This doesn't seem to be possible in this port. Am I missing something or is this potentially a gap in parity?

Cheers!

[DevTobias]

Hi! I think this is not possible right now. I can try to implement this if I find the free time for it. Also feel free to open a pr for this, I would gladly take a look at it :)

[gtramontina]

Thanks, @DevTobias. I can't promise a PR, but might eventually do it. From a quick glance at the codebase, it seems we'll need to forward both request and response from the plugin definition into the CSP policy in order to enable something like the above.