Web Security · Middle · Question 21 of 75

In Next.js, how is a nonce-based CSP usually set up?

1The nonce is placed in next.config.js once for all requests
✓Correct answer: Middleware or a proxy creates a nonce per request, sets the CSP header, and Next.js adds the nonce to its scripts
3Next.js pages can't use CSP

Explanation

A per-request nonce means pages are rendered dynamically. Static pages can use hashes or a less strict policy instead.

Further reading

Next.js: Content Security Policy ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.