What is the difference between CSP nonce and hash?

What is the difference between CSP nonce and hash?

CSP nonce and hash are both used in Content Security Policy to allow specific scripts. A nonce is a random value that is generated for each request, while a hash is a fixed value derived from the script's content.

Can you give me an example of how to use a nonce?

Sure! In your HTML, you would add a nonce attribute to your script tag, like this: <script nonce="randomNonceValue">...</script>. The server must generate a new random nonce for each request.

And how does a hash work in this context?

A hash is created by taking the script's content and generating a SHA-256 hash. You then include this hash in your CSP header, like this: Content-Security-Policy: script-src 'sha256-<hashValue>'.

Which method is more secure, nonce or hash?

Both methods have their strengths. Nonces are more flexible as they allow dynamic scripts, while hashes provide a way to ensure the exact script content hasn't changed.