Source evidence

Can your plugin do nonce?

GD Security Headers · support · 2024-02-23T16:46:00+00:00

GD Security Headers plugin evidence original source source API

mixedsentiment

highseverity

0.88relevance

3replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 31 rows with source links

19.4% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

25 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

Gevorg resolved

Hello I am currently testing your plugin for a website that I work on. I would like to know is it currently possible to add a “nonce” security token to all the needed content element tags? A “nonce” security token which is unique and is generated anew each time a page is loaded. Currently it’s possible in your plugin to add the hashes of all the content elements to the CSP, but this needs to be done manually, right? Does your plugin have any means to recognize these hashes automatically and add them to the CSP rule-set? Sincerely, Gevorg With WordPress, this would be next to impossible. When you consider cache plugins, implementing auto nonce can’t be done without some standardization for CSS and JS that every cache plugin will adopt. I have tried it myself with a manual solution and it was not feasible with WordPress. Each time the user makes inline changes, be it CSS or JavaScript, the new hashes need to be added to the CSP rule. And some installed plugins have the habit of loading external content belatedly, the very same thing which CSP is supposed to prevent. I have not thought about cache plugins, this may make it even more complicated. Yeah, it is unlikely this can get implemented at all.

Commercial Context

Opportunity

trust and abuse-prevention operations

trust and abuse-prevention operations for keeping sites trusted, protected, and recoverable

Buyer: site owners, agencies, and maintenance teams

Wedge: turn security and abuse signals into prioritized actions, audit trails, and recovery-ready reporting

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: Can your plugin do nonce?: users show security, missing feature, setup pain that may indicate a product gap.

Evidence quote: I would like to know is it currently possible to add a “nonce” security token to all the needed content element tags?

Affected feature: cache

security missing feature setup value

Plugin

API

GD Security Headers

1.0K active installs · 32.1K downloads · rating 80.0

content security policy csp dev4press permission policy security

Comments

3 shown

Milan Petrovic 2024-06-06T13:53:00+00:00

With WordPress, this would be next to impossible. When you consider cache plugins, implementing auto nonce can’t be done without some standardization for CSS and JS that every cache plugin will adopt.

Gevorg 2024-06-06T15:59:00+00:00

I have tried it myself with a manual solution and it was not feasible with WordPress. Each time the user makes inline changes, be it CSS or JavaScript, the new hashes need to be added to the CSP rule. And some installed plugins have the habit of loading external content belatedly, the very same thing which CSP is supposed to prevent. I have not thought about cache plugins, this may make it even more complicated.

Milan Petrovic 2024-06-07T08:20:00+00:00

Yeah, it is unlikely this can get implemented at all.