Content Security Policy nonce support doesn't support content-security-policy-report-only

[danieltott]

Verify canary release

• I verified that the issue exists in the latest Next.js canary release

Provide environment information

Operating System:
      Platform: darwin
      Arch: x64
      Version: Darwin Kernel Version 22.4.0: Mon Mar  6 21:00:41 PST 2023; root:xnu-8796.101.5~3/RELEASE_ARM64_T8103
    Binaries:
      Node: 16.19.1
      npm: 8.19.3
      Yarn: 1.22.19
      pnpm: 7.23.0
    Relevant packages:
      next: 13.3.2-canary.12
      eslint-config-next: 13.3.2-canary.12
      react: 18.2.0
      react-dom: 18.2.0

Which area(s) of Next.js are affected? (leave empty if unsure)

App directory (appDir: true), Middleware / Edge (API routes, runtime)

Link to the code that reproduces this issue

https://github.com/Sprokets/nextjs-csp-report-only

To Reproduce

Go to https://nextjs-csp-report-only.vercel.app/csp, view the page source, and see that nonce is applied to (some) scripts.

Then go to https://nextjs-csp-report-only.vercel.app/csp-report-only, view the page source, and see that there are no scripts with nonce attribute.

Note: There is an existing issue #43743 where nonce attributes aren't being properly included. This issue is not related to that. However, because of that issue, browsers will be blocking most of the runtime js on the page with the content-security-policy applied. This can be ignored for the purposes of this issue.

Describe the Bug

Currently, renderToHTMLOrFlight in app-render pulls out a nonce value from a content-security-policy header for use in generating script tags:

next.js/packages/next/src/server/app-render/app-render.tsx

Line 1204 in e7c9d3c

const csp = req.headers['content-security-policy']

This is missing the ability to use a content-security-policy-report-only header. Many times this is a required step to enabling a CSP - by shipping a CSP with report-only and collecting reports before actually blocking resources.

Expected Behavior

NextJS renders a site implementing a content-security-policy-report-only in the same way it does for sites using a content-security-policy header (ie reads and applies the nonce value).

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

All platforms

[Klemensas]

Also missed this feature. I see there's an outstanding PR, any way to move it?

[github-actions]

This closed issue has been automatically locked because it had no new activity for 2 weeks. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.