Content-Security-Policy / nonce error in DOMEval about jquery

[mgol]

As you can see in DOMEval code, it does copy the nonce property from the source node. Whatever issue you’re facing needs to originate in a different part of the code.

The workaround for your issue wouldn’t be correct in general as document.head doesn’t have the nonce property unless it’s set from JavaScript.

We need a test case that doesn’t involve third-party libraries.

[vpkg]

I finally understood why : it was because of the missing strict-dynamic in my CSP header
I had this one script-src 'self' https://www.google.com/ https://www.gstatic.com/ 'nonce-%s' because I needed self and google.com.
Now I reverted to the standard struts2 CSP script-src 'nonce-%s' 'strict-dynamic' http: https: and I will have to change all my <script> tags into <s:script> even those referring to the .js inside my app.