Cloudflare CSP Worker

Cloudflare CSP Worker.js

addEventListener('fetch', event => {
 event.respondWith(handleRequest(event.request))
})

/**
* Fetch a request and return the response, with CSP applied
* @param {Request} request
*/
async function handleRequest(request) {
 randomNonce = generateNonce(20)
 request = new Request(request)
 request.headers.set('x-random-csp-nonce', randomNonce)
 let response = await fetch(request)

 response = new Response(response.body, response)
 response.headers.set('Content-Security-Policy', 'object-src \'none\'; script-src \'nonce-' + randomNonce + '\' \'unsafe-inline\' \'unsafe-eval\' \'strict-dynamic\' https: http:; base-uri \'none\';')

 return response
}