title: Reuse CSP script nonce throughout the session?
body: <p>This is a follow-up of <a href="https://github.com/w3c/webappsec-csp/issues/215" rel="nofollow noreferrer">https://github.com/w3c/webappsec-csp/issues/215</a>. <a href="https://github.com/arturjanc" rel="nofollow noreferrer">arturjanc</a> suggested to move this discussion to stackoverflow.</p>
  
  <p>We are trying to implement CSP for scripts in JSF and don't know if it is safe to reuse a script nonce throughout the session. Or, like arturjanc suggested, have the original document send its current nonce to the server which generates future responses.</p>
  
  <p>Assuming that it is unsafe to reuse the nonce throughout the session, would it be okay to just include the initial nonce in hidden form input like currently implemented <a href="https://github.com/primefaces/primefaces/commit/c614e01cd4a5dca71487f5c0852478ddfd6a58dc" rel="nofollow noreferrer">here</a>. (ignoring the CSP header/XSS injection vulnerabilities for the moment - it's just a prototype)</p>
  
  <p>@arturjanc: Would you like to chime in again?</p>
  
  <p>Edit: Additional thoughts regarding arturjanc's answer:</p>
  
  <p>Could you please elaborate a bit more on how to implement per-response nonces in a typical JSF application of nowadays, i.e. just having one single full page load at the very beginning and subsequent XHR-only communication? </p>
  
  <p>If I understand you correctly, your suggestion would be then to always resend the initially generated nonce in every XHR request. However, in practice this is effectively the very same as nonces per session, isn't it? Just more complicated in terms of implementation. </p>
  
  <p>Strictly implementing per-response nonces would imply that subsequent responses must also include all nonces created earlier in that session, so we would somehow track all nonces of the session. </p>
  
  <p>Setting new CSP headers for each XHR-response containing only the newly created per-response nonce, would probably not work due to browsers treating multiple CSP headers across responses by merging them using an intersection strategy, i.e. <code>Content-Security-Policy: 'nonce-1'</code> in response 1 and <code>Content-Security-Policy: 'nonce-2'</code> in response 2 would render both nonces invalid after response 2.</p>