Panduan Kejuruteraan: Freelance Programmer: Strict Content-Security-Policy (CSP Nonces) & HSTS. Aldian Fazrihady ialah Programmer Bebas Kanan & Jurutera AI (Python, Django, FastAPI, React, Next.js, TypeScript, Golang).
Achieve an A+ Mozilla Observatory security rating and neutralize XSS injection vectors with per-request cryptographic CSP nonces (`strict-dynamic`) implemented by Aldian Fazrihady.
import secrets
def build_strict_csp_header() -> tuple[str, str]:
nonce = secrets.token_base64(16) if hasattr(secrets, "token_base64") else secrets.token_urlsafe(16)
policy = f"default-src 'self'; script-src 'self' 'nonce-{nonce}' 'strict-dynamic'; object-src 'none'; base-uri 'self';"
return nonce, policy