I have a content security header containing a randomly generated nonce on each request.

All scripts within the html document have a nonce attribute with correct associated value.

All seems to be working ok except for a script loaded from within compiled React script

The problem: The bundled React js file is blocked by CSP and not loaded by the browser even if I add a nonce to the script tag.

I use these CSP directives: Content-Security-Policy: script-src 'strict-dynamic' 'nonce-{0}' 'unsafe-eval' unsafe-inline

This is how the script tag looks like. @nonce is replaced at the runtime.

<script nonce='@nonce' src='{someUrl}/app.js' defer> </script>