After Enabling Nonce for my Website's CSP, Functionality is Broken

Develop, Build & Integrate CMS Development
1

Hi,

I am trying to remove ‘unsafe-inline’ from my website’s CSP. It seems that HubSpot loads module scripts as inline script tags.

As per this documentation, https://knowledge.hubspot.com/domains-and-urls/ssl-and-domain-security-in-hubspot?_gl=1*1pwjzxj*_ga*NTczOTM4NzIyLjE3NDAwNzc2NTg.*_ga_LXTM6CQ0XK*MTc0MDA3ODgyNy4xLjAuMTc0MDA3ODgyNy42MC4wLjA.#content-security-policy, enabling nonce should allow inline scripts to continue to function without unsafe-inline.

However, after enabling nonce and removing unsafe-inline from my website’s CSP, the scripts for my custom modules are being blocked.

Can anyone advise?

2

Hi @EJacobson,

Confirming that the information is accurate and enabling nonce does indeed allow you to remove ‘unsafe-inline’ from the ‘scrtip-src’ in you CSP directive - I had this done on multiple HubSpot sites.

Could you share what errors you are seeing on your end?

3

Thank you for your response. My custom modules are not functioning (for example, there is a dropdown that uses JavaScript, and it is not opening), and I see CSP violation errors in the console in the regular format - "refused to load … because it violates the following Content-Security-Policy directive: “script-src …”.

Any advice that you have would be much appreciated.

4

It is hard to tell without seeing the full error, but I would guess it could most likely be one of the following missing in the script-src:

  • ‘self’
  • HubSpot domains/wildcards (i.e. static.hsappstatic.net, *.hs-scripts.com,*.hubspot.net, etc)
  • jQuery

Usually the CSP violation error should help investigate which part of the CSP directive is the culprit.