I have an Angular app + NET 8 API together hosted in an IIS site.

I’m trying to implement the Content Security Policy using ‘nonce’ (number used only once). This means that for each response sent to a client, I have to set a new ‘nonce’ in the index.html before delivering it.

Is IIS able to generate a new nonce for each HTTP request received and make the replacement in variables inside my index.html, before sending it to the client in the HTTP Response?

I was trying to do it with IIS URL Rewrite Outbound rules. But I couldn’t make it so far. I didn’t find a way to make the replacement in the index.html, neither the way to autogenerate a nonce for each incoming request.