in 2026 were seeing more devs move to nonce-based csp for better xss protection. heres how you can do it safely: generate a new random
16-byte nonces per request and update your express app
import {randomBytes} from 'crypto'; const generateNonce = (): string => {.this way, inline scripts need the right nonce to run which prevents most xss attacks. but remember - wrong setup can break everything! have you tried this method yet? any tips for a smooth transition?
i heard some devs use report-only mode first before switching fully over ⚡
more here:
https://dev.to/myougatheaxo/claude-codedecontent-security-policywoshe-ji-suruxssfang-zhi-noncereport-onlyyi-xing-1n8i