--- area: "Learn" parent: "Scripting chapter" url: "https://unpoly.com/learn/script-security" --- # Script security This page explains how Unpoly's scripting facilities affect security, and how to make them work with a strict [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) (or CSP). Unpoly extends HTML with [attributes that contain JavaScript](#attribute-callbacks), and might also run [` ``` You can configure a stricter behavior for new fragments with [`up.script.config.scriptElementPolicy`](https://unpoly.com/api/up.script.config.md#config.scriptElementPolicy): | `scriptElementPolicy` | Runs without CSP? | Runs with CSP? | Runs with `strict-dynamic` CSP? | | --- | --- | --- | --- | | `auto` (default) | Always | If passes CSP | With allowed nonce | | `pass` | Always | If passes CSP | ⚠️ Always | | `block` | Never | Never | Never | | `nonce` | With allowed nonce | With allowed nonce | With allowed nonce | > #### Note > > Configuration will only affect new fragments in the ``. The initial page load is solely governed by your CSP. ### Restricting script elements with nonces {#script-element-nonces} If you want to be restrictive about ` ``` Nonces in your HTML only need to match the response you're currently rendering. Unpoly will [rewrite your HTML](#nonce-rewriting) so all allowed nonces match the current document. ### Nonces required with `strict-dynamic` {#strict-dynamic} A CSP with [`strict-dynamic`](https://content-security-policy.com/strict-dynamic/) allows any allowed script to load additional scripts. Because Unpoly is already an allowed script, this would allow _any_ Unpoly-rendered script to execute. To prevent this, Unpoly requires [matching CSP nonces](#script-element-nonces) in any response with a `strict-dynamic` CSP. ## Nonces are rewritten {#nonce-rewriting} The CSP header from the initial page load exclusively defines the nonces allowed for the lifetime of the document. When Unpoly loads new fragments from the server, any nonces will match their own response, but not the existing document. To address this, Unpoly will verify and rewrite nonces before a fragment is placed into the page. For this Unpoly needs to know your [CSP nonce](#meta-csp-nonce). ### How responses are altered {#response-processing} ```http Content-Type: text/html Content-Security-Policy: script-src 'self' 'nonce-match456' ... ``` Note how nonces in your HTML only need to match the response you're currently rendering. You do _not_ need to track and re-use the nonce of the initial page load. ### Only `script-src` directives are supported {#only-script-src-directives-are-supported} Unpoly's CSP parser has some limitations: - When verifying responses, only the `script-src` directive is parsed. - A `default-src` directive is parsed if no `script-src` directive is set. - The `script-src-elem` and `script-src-attr` directives are not currently supported. - Unpoly does not rewrite CSP nonces for non-script elements, such as stylesheets or images.