Skip to main content
verifyngo can emit Content-Security-Policy headers in two different places, depending on the response type:
  • Challenge pages (cap.use_nonce = true): every challenge render gets a fresh per-request nonce, applied to the page’s inline scripts/styles and exposed to Cap’s widget via window.CAP_CSS_NONCE / window.CAP_SCRIPT_NONCE. A Content-Security-Policy header is emitted (script-src 'nonce-…' 'strict-dynamic' 'wasm-unsafe-eval', plus style-/img-/font-/connect-src allowlists derived from cap.api_url, cap.verify_url, cap.widget_script_url, and the branding.* URLs). Override it entirely with cap.csp, using {nonce} as a placeholder for the per-request nonce.
  • Proxied responses (response_csp): a static policy applied to every upstream response, unless the upstream already sent its own Content-Security-Policy. It can’t use nonces (verifyngo can’t inject them into HTML it doesn’t own), so include 'unsafe-inline'/'unsafe-eval' as your app requires.