Jeremy Daer 9c8f4cd272 Keep the CSP nonce cookie off public cacheable responses ...

The nonce generator runs for every response that carries the policy, so
the nonce_id cookie was set on QR codes, logos, avatars and disk-served
blobs — all public, shared-cacheable. Those endpoints now opt out of the
policy, so no cache can replay one client's identifier and nonce.

2026-09-13 17:01:24 -07:00

..

csp_nonce_test.rb

Keep the CSP nonce cookie off public cacheable responses

2026-09-13 17:01:24 -07:00