Cloudflare Zaraz supports CSP

What this post added

This post details how Cloudflare Zaraz integrates with Content Security Policy (CSP) by dynamically adding a nonce to the script-src policy when auto-injection is enabled. It explains the technical challenges of CSP, such as handling multiple CSP headers and the interaction between 'unsafe-inline' and nonces, and outlines the logic implemented to ensure Zaraz scripts are not blocked while maintaining CSP's security guarantees. It also notes current limitations regarding tools using _eval()_ and the non-modification of CSP-Report-Only headers.