Summary

Acunetix 360 detected that the nonce value declared in CSP is not within single quotes.

Impact

When nonce value is not used within single quotes, it will be considered as a part of the resource URL. This will cause relevant script block to not run.

Remediation

Use nonce values within single quotes, i.e.

Content-Security-Policy: script-src 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa';

Severity

Information

Classification

CWE-16 ISO27001-A.14.2.5 WASC-15 OWASP 2013-A5 OWASP 2017-A6