问快件/ CSP / ejs /内联-脚本& NONCES:如何？
EN

Stack Overflow用户

提问于 2022-01-31 02:41:37

回答 1查看 668关注 0票数 0

，我想做的是：

1.)使用快件-csp-标头生成一个名为

2.)将生成的当前内容注入.ejs模板

3.)使用该值允许在模板内插入一个内联脚本。

，这是实际发生的事情(据我所知)：

1.)现在生成

2.)成功传递给“index.ejs”，然后转发给“head.ejs”

3.)模板('index.ejs')被呈现，并且由于静态资产被请求，生成一个新的NONCE (或几个非new ).

4.)，它使传递给模板的时间无效。

，以下是我目前正在做的事情：

// server.js
const { expressCspHeader,NONCE } = require("express-csp-header");

app.use(
    expressCspHeader({
        directives: {
            "script-src": [
                SELF,
                [NONCE],
            ],
        },
    })
);

// middleware to log the current NONCE attached to the 'request object'
app.use(function (req, res, next) {
    console.log(" ---------------------------------> NONCE", req.nonce);
    next();
});

app.get("/", (req, res) => {
console.log("app.get('/')");
console.log("passed NONCE to '/' route: ------> ", req.nonce);
res.render("pages/index", {
  nonce: req.nonce,
  });
});

<!-- index.ejs -->
<!DOCTYPE html>
<html lang="en">
    <head>
    <!-- Passing the received NONCE to 'head.ejs' -->
    <%- include ("../partials/head.ejs", {nonce: nonce}) %>
    </head>
    <body>
    </body>
</html>

<!-- head.ejs -->
<title>Title</title>
<% console.log("head.ejs: received NONCE:   ------>", nonce) %>
<!-- My Inline Script -->
<script nonce='<%= nonce %>'>
  console.log("I am an inline script!")
</script>

<!-- more CSS -->
<link rel="stylesheet" href="../../static/css/global/header.css" />
<link rel="stylesheet" href="../../static/css/global/footer.css" />

当我使用 摩根 记录所有请求时，我的问题变得很明显：

---------------------------------> generated NONCE:  7CpDuxCZCSrRfmNCVBnkUg==
app.get('/')
passed NONCE to '/' route: ------>  7CpDuxCZCSrRfmNCVBnkUg==
head.ejs: received NONCE:   ------> 7CpDuxCZCSrRfmNCVBnkUg==
GET / 200 30.562 ms - -
---------------------------------> generated NONCE:  fpcpM9o/Ab3g5bSUmymAOg==
---------------------------------> generated NONCE:  5ElxDy+WboVga1We5L/v1g==
GET /static/css/global/header.css 304 4.227 ms - -
GET /static/css/global/footer.css 304 2.141 ms - -

那么我该如何解决这个问题呢？感谢读过这篇文章的人，非常感谢。

express

ejs

content-security-policy

nonce

在线客服搭建方案

搭建集AI机器人、在线客服、智能外呼等多功能服务的客服系统，支持快速接入及自搭建客服系统，从而让顾客快速得到解答

回答 1

Stack Overflow用户

发布于 2022-01-31 04:23:06

，这是真正发生的事情：

1.)非test正在工作，我只是没有在常规的脚本上测试它们，而是在一个有其他CSP问题的脚本上测试它们，而不是一个无效的当前脚本。

2.)我不知道Express静态文件夹是如何工作的，这导致了一个糟糕的请求流。线：app.use("/static", express.static(path.resolve(__dirname, "static")));

位于“Express CSP报头”中间件之上。因此，对/static中的文件的每个GET请求首先运行在CSP-中间件中，然后才提供静态资产。下面是将'express.static‘线移动到链上的前后的日志。

在此之前：

Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  Y8fG4FXkWGCa66b4DNNtOw==
app.get('/')
passed NONCE to '/' route: ------>  Y8fG4FXkWGCa66b4DNNtOw==
head.ejs: received NONCE:   ------> Y8fG4FXkWGCa66b4DNNtOw==
GET / 200 35.642 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  TnaEqWMKHwRNG5LyP/4YFA==
GET /static/css/global/header.css 304 2.280 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  RGJrqm3qZspjUHKlMagm5Q==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  rHO67xdswBY9N4wBDfoyFg==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  8LpyqQdvIa28HTIjTR9pKw==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  3v31KoRNjYwf+ajfXNNXhw==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  sMUYhgkcYDMXHDMNOTnRlA==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  0Zaa33QPteaaWUBbZLhZXA==
GET /static/css/global/footer.css 304 3.056 ms - -
GET /static/css/global/global.css 304 2.734 ms - -
GET /static/slick/slick-theme.css 200 5.107 ms - -
GET /static/css/global/hamburger.css 200 3.803 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  Ly7ri0OUnaJeSTRXrO2Uxg==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  zAuXEhaJ2qpNP1FmLGYnHw==
GET /static/svelte/svelte.css 200 3.464 ms - -
GET /static/slick/slick.css 200 3.135 ms - -
GET /static/svelte/svelte-bundle.js 304 1.730 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  Xxh74qC5kvUs/6iVP5Ckcg==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  ndLVatznuuJo3lxnSQn07g==
GET /static/script.js 304 1.184 ms - -
GET /static/index_slider.js 200 1.215 ms - 853
GET /static/css/layouts/index.css 200 4.673 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  rmEunrBHysX1cBANuHcE9A==
GET /static/slick/slick.min.js 304 0.528 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  VVwVknnFqpwHI+UAVGDiQA==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  y9xb6FAw+noMTMlCMBN47g==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  huz3j8ipoAGkttl58TuV6A==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  /v8kVXw7eGvDcL8N1Uoz4g==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  jqiudorrrgj/8K+8swOhpg==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  csT6iBmrcaXxXrnnWO9qUQ==
GET /static/images/rw.webp 304 2.959 ms - -
GET /static/images/svg/logo_grey.svg 304 2.823 ms - -
GET /static/images/icon_facebook.svg 304 2.636 ms - -
GET /static/images/icon_twitter.svg 304 2.506 ms - -
GET /static/images/icon_instagram.svg 304 2.457 ms - -
GET /static/images/icon_hamburger_grey.svg 304 2.211 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  uJQGA7rnyYyZWMOo5Vg4yQ==
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  OOUmFVdAahTWtR+PsKOdFg==
GET /static/images/icon_slider_next.svg 304 0.656 ms - -
GET /static/images/icon_slider_prev.svg 304 0.572 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  J9oz/sb0cmlhjmy47Hmf1Q==
GET /static/slick/slick.min.js 304 1.046 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  jWb0xdpZdpUGUTjAr32dVw==
GET /static/svelte/svelte-bundle.js 304 0.609 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  0vGtGk3oRXYEFEf0Re6JFw==
GET /static/script.js 304 0.558 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  tIeYKbs/NhOWWr3GAo8scw==
GET /static/svelte/svelte-bundle.js.map 304 0.422 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  TXSm/L4nTgd5mVRQGmyOtg==
GET /static/index_slider.js 304 0.624 ms - -
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  yrGsmQMHw8+/ap/qdquy+g==
GET /static/slick/ajax-loader.gif 304 0.568 ms - -

之后：

Server running on port 1339
Before Express CSP Header Middleware
-------------------------------------------> generated NONCE:  wkMabZKUD8et0YL4qjHzvw==
app.get('/')
passed NONCE to '/' route: ------>  wkMabZKUD8et0YL4qjHzvw==
head.ejs: received NONCE:   ------> wkMabZKUD8et0YL4qjHzvw==
GET / 200 37.994 ms - -
GET /static/css/global/header.css 304 1.253 ms - -
GET /static/css/global/footer.css 304 1.497 ms - -
GET /static/css/global/hamburger.css 304 1.392 ms - -
GET /static/svelte/svelte.css 304 1.402 ms - -
GET /static/svelte/svelte-bundle.js 304 1.355 ms - -
GET /static/css/global/global.css 304 1.276 ms - -
GET /static/slick/slick.css 200 1.454 ms - -
GET /static/slick/slick-theme.css 200 1.113 ms - -
GET /static/script.js 304 0.539 ms - -
GET /static/index_slider.js 200 2.022 ms - 853
GET /static/slick/slick.min.js 304 0.959 ms - -
GET /static/css/layouts/index.css 200 1.647 ms - -
GET /static/images/icon_facebook.svg 304 0.624 ms - -
GET /static/images/icon_twitter.svg 304 0.747 ms - -
GET /static/images/icon_slider_prev.svg 304 0.581 ms - -
GET /static/images/icon_slider_next.svg 304 0.473 ms - -
GET /static/images/rw.webp 200 3.326 ms - 44096
GET /static/images/icon_instagram.svg 304 1.325 ms - -
GET /static/images/icon_hamburger_grey.svg 304 1.371 ms - -
GET /static/images/svg/logo_grey.svg 200 3.797 ms - -
GET /static/slick/slick.min.js 304 0.383 ms - -
GET /static/svelte/svelte-bundle.js 304 0.533 ms - -
GET /static/script.js 304 0.412 ms - -
GET /static/svelte/svelte-bundle.js.map 304 0.340 ms - -
GET /static/index_slider.js 304 0.317 ms - -
GET /static/slick/ajax-loader.gif 304 0.267 ms - -