16 lines
530 B
TypeScript
16 lines
530 B
TypeScript
import { randomBytes } from "node:crypto";
|
|
|
|
import { CSP_NONCE_REQUEST_HEADER, isValidCspNonce } from "../apps/web/app/utils/security/contentSecurityPolicy";
|
|
|
|
export function createRequestCspNonce(): string {
|
|
return randomBytes(18).toString("base64url");
|
|
}
|
|
|
|
export function overwriteRequestCspNonce(headers: Headers, nonce = createRequestCspNonce()): string {
|
|
if (!isValidCspNonce(nonce)) {
|
|
throw new Error("Request CSP nonce has an invalid format.");
|
|
}
|
|
headers.set(CSP_NONCE_REQUEST_HEADER, nonce);
|
|
return nonce;
|
|
}
|