能否用cURL查看nonce值？Google File Picker代理缓存CSP错误

问题说明 #

我在网站中集成了Google File Picker，使用代理缓存时遇到异常：请求https://apis.google.com/js/googleapis.proxy.js?onload=startup的缓存响应会触发Content Security Policy（CSP）错误。

流程起始于请求https://content.googleapis.com/static/proxy.html，返回内容里包含带nonce值的script标签；后续请求上述proxy.js时，缓存状态下请求失败。按照CSP逻辑，proxy.js的响应应当包含对应nonce值的CSP头，但实际并未发现该头部。

能否用cURL查看nonce值？ #

可以。通过cURL请求proxy.html，就能从响应内容中提取到nonce值，具体信息如下：

请求proxy.html的cURL命令 #

curl 'https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__' \
  -H 'authority: content.googleapis.com' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'accept-language: en-GB,en-US;q=0.9,en;q=0.8' \
  -H 'if-modified-since: Fri, 30 Jun 2023 18:58:00 GMT' \
  -H 'referer: http://localhost:3000/' \
  -H 'sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: iframe' \
  -H 'sec-fetch-mode: navigate' \
  -H 'sec-fetch-site: cross-site' \
  -H 'upgrade-insecure-requests: 1' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36' \
  -H 'x-client-data: CJC2yQEIpLbJAQipncoBCEzdygEIlqHLAQiGoMBBCLvIzQEIucrNAQiK080BALzUzQEYj87NAQ==' \
  --compressed

proxy.html响应内容（含nonce） #

<!DOCTYPE html>
<html>
<head>
<title></title>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<script nonce="0dydr7sqTq3pOrRxZ6JvvQ">
  window['startup'] = function() {
    googleapis.server.init();
  };
</script>
<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="0dydr7sqTq3pOrRxZ6JvvQ"></script>
</head>
<body>
</body>
</html>

proxy.js缓存问题细节 #

请求proxy.js的cURL命令：

curl 'https://apis.google.com/js/googleapis.proxy.js?onload=startup' \
  -H 'sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"' \
  -H 'Referer: https://content.googleapis.com/' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36' \
  -H 'sec-ch-ua-platform: "macOS"' \
  --compressed

该请求的响应头中未包含带nonce值的CSP头，这是缓存后触发CSP错误的核心原因。

内容的提问来源于stack exchange，提问作者Žilvinas Rudžionis