# Controlling Scripts With Content Security Policy: Hashes, Nonces, and strict-dynamic

Page: https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic
Text version: https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic.md
Podcast: [Cybersecurity Tech Brief By HackerNoon](https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646)
Published: 2026-07-14T16:01:31+00:00
Episode link: https://share.transistor.fm/s/ab8be064
Audio file: https://media.transistor.fm/ab8be064/294493f8.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cybersecurity-tech-brief-by-hackernoon-6365646/episodes/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic
Duration seconds: 793

## Resource

This story was originally published on HackerNoon at: https://hackernoon.com/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic . Learn how CSP script-src controls what scripts can be executed with allowlists, hashes, nonces, strict-dynamic, script-src-elem and script-src-attr. Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity . You can also check exclusive content about #content-security-policy , #csp , #web-security , #browser-security , #xss , #javascript-security , #xss-prevention , #hackernoon-top-story , and more. This story was written by: @darevskaya . Learn more about this writer by checking @darevskaya's about page, and for more stories, please visit hackernoon.com . Content Security Policy’s script-src directive controls which scripts a page can run, but how you use it depends on the case. Origin allowlists are simple, but they trust every script from an allowed domain. Hashes work well for static inline scripts. Nonces are better for dynamic HTML generated per response. strict-dynamic helps when a trusted script needs to load other scripts. For legacy inline event handlers, script-src-elem and script-src-attr can make CSP adoption more gradual.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cybersecurity-tech-brief-by-hackernoon-6365646/episodes/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/controlling-scripts-with-content-security-policy-hashes-nonces-and-strict-dynamic.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.