I’m using Rails 6.1.7 and trying to configure CSP in my application. I already have the file content_security_policy.rb configured:

Rails.application.config.content_security_policy do |policy|
  policy.script_src  :self, :https
  policy.style_src   :self, :https
end

Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }

Rails.application.config.content_security_policy_nonce_directives = %w(script-src style-src)

Now, if I add the nonce attribute in all script tags, like:

<script nonce="<%= request.content_security_policy_nonce %>">

it works, and I no longer see the CSP violate errors in the browser console.

Is there a way to automatically add the attribute in all tags instead of doing that for each one? And how to do this for the inline styles? What is the best practice when handling CSP for inline scripts/styles?