RUM | CSP | Nonce or Hash, how to add to JavaScript tag (and CSP header) manually

[fstekelenburg]

Due to the increasing security contraints of our customers we are looking at the impact and requirements to have RUM working with CSP applied, as also described in Modify Content Security Policy for RUM | Dynatrace Documentation. 

Unsafe_inline is generally still used and set in CSP, however we have to move to make use of Nonce or Hash instead, which, according to the documentation, for Auto Injection yet not supported.

We have a case where, using Manual Injection by using JavaScript tag in a Managed environment, we need to investigate to use Nonce instead. According to Modify Content Security Policy for RUM | Dynatrace Documentation, "Nonce can be added manually to the script tag and the CSP header must be set up accordingly." However, there aren't any further pointers how to accomplish that.
How do we add Nonce to the JavaScript tag?

[fstekelenburg]

Any pointers on how to correctly define the CSP for Agentless RUM manual insertion of Managed are highly appreciated. Taking in account that the URL of the Cluster ActiveGates behind a LB+WAF are within the customer's own domain.

A "Content-Security-Policy: default-src 'self' trusted.com *.trusted.com" is thinkable, if the CAGs reside at cag.trusted.com? What if the use of hash or nonce is demanded?

Nobody encountered the contraint yet, to prevent the use of unsafe-inline in CSP, if that is applicable at all ?

[AntonioSousa]

Yes, we are in 2025, with still not a solution yet.

Not to say that it is not that easy to address, but Dynatrace doesn't have a response for this.

In the past, I had one case where I had to dump RUM because of this issue. At the moment I have a special case where I'm going to try something: get the hash, insert it into CSP, and configure Dynatrace so RUM version does not get updated...

[peteh]

This is also a limitation we are facing - that our software developed in house, has requirement from our customers to protect against <script> injections, by using a nonce token and strict-dynamic Content-Security-Policy

Automatic injection from OneAgent lacks the nonce token, requiring us to explore other injection avenues for ruxitagent