{{- /* 1. Generate a unique, random nonce for this request */ -}}
{{- $nonce := uuidv4 -}}
{{- /* 2. Build a secure CSP string. Practical compromise: keep
script-src strict (nonce required), but allow runtime-injected styles by using
'unsafe-inline' for styles and NOT including a nonce for style-src. This avoids
the browser ignoring 'unsafe-inline' when a nonce is present. */ -}}
{{- $csp := printf "default-src 'self'; script-src 'self' 'nonce-%s' https://o4509122860941312.ingest.de.sentry.io; style-src 'self' 'unsafe-inline'; font-src 'self'; worker-src 'self' blob:; img-src 'self' blob: data:; media-src 'self' blob:; connect-src 'self' https://o4509122860941312.ingest.de.sentry.io https://*.canvaspro.tech wss://*.canvaspro.tech; object-src 'none'; frame-ancestors 'none';" $nonce -}}
{{- /* 3. Set the response header from within the template */ -}}
{{- .RespHeader.Set "Content-Security-Policy" $csp -}}
CanvasPro