From 17a1924d54220d30504b6bcbaf055278f0b3c755 Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Tue, 3 Nov 2026 20:45:30 +0100
Subject: [PATCH 1/5] fix(hosting,inertia): nonce-based production CSP; sandbox
 CSPs intersect; RedactionFilter redacts tracebacks

- production script-src/script-src-elem: 'self' 'nonce-<per-request>'
  'strict-dynamic', no 'unsafe-inline'/'unsafe-eval'; the host and scaffold
  templates and the Inertia adapter's module tags carry the nonce
  (request.state.csp_nonce); development keeps the Vite/HMR policy (#785)
- a response CSP with `sandbox` is sent beside the app policy so browsers
  enforce the intersection (#785)
- SPA mounts stamp the nonce onto their index.html scripts and drop its
  validators
- RedactionFilter formats and redacts exc_info and stack_info on plain
  handlers (#789)

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 CHANGELOG.md                                  |   9 ++
 docs/framework-conventions.md                 |   8 ++
 docs/framework/lifecycle.md                   |  11 +-
 docs/framework/middleware.md                  |  16 ++-
 docs/framework/spa-mounts.md                  |   8 +-
 docs/module-authoring.md                      |   8 ++
 docs/modules/file_storage.md                  |   3 +-
 .../templates/host/templates/index.html       |   2 +-
 .../simple_module_hosting/_spa_mount.py       |  27 +++-
 .../simple_module_hosting/log_sinks.py        |   4 +
 .../simple_module_hosting/middleware.py       |  34 +++--
 .../hosting/tests/test_hosting_csp_nonce.py   | 120 ++++++++++++++++++
 ...iders.py => test_hosting_csp_providers.py} |   4 +-
 .../hosting/tests/test_hosting_log_sinks.py   |  37 ++++++
 .../tests/test_hosting_spa_mount_nonce.py     |  44 +++++++
 .../simple_module_inertia/templating.py       |  12 +-
 host/templates/index.html                     |  10 +-
 .../test_file_storage_p3_download_csp.py      |   4 +-
 18 files changed, 329 insertions(+), 32 deletions(-)
 create mode 100644 framework/hosting/tests/test_hosting_csp_nonce.py
 rename framework/hosting/tests/{test_csp_providers.py => test_hosting_csp_providers.py} (97%)
 create mode 100644 framework/hosting/tests/test_hosting_spa_mount_nonce.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4566e07b7..417130648 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,15 @@ All notable changes to this project are documented in this file. The format is b
   `account` or whose `azp` is another client (only `oidc` pins both).
 
 ### Fixed
+- **Behaviour change:** production scripts require a per-request CSP nonce and
+  use `strict-dynamic`, without script `unsafe-inline` or `unsafe-eval`.
+  The host/scaffold templates and Inertia entry scripts carry the nonce;
+  custom templates must add `request.state.csp_nonce` to executable scripts,
+  and static SPA shells need nonce-aware HTML serving.
+  Sandbox response policies are enforced alongside the app CSP (#785).
+- **Behaviour change:** `RedactionFilter` on ordinary logging handlers masks
+  secrets in tracebacks and stack information, including exception text not
+  yet formatted when the filter runs (#789).
 - **Behaviour change:** Inertia GETs with a missing asset-version header now
   receive 409 when the server version is non-empty; version conflicts include
   both `X-Inertia-Location` and the current `X-Inertia-Version` (#774).
diff --git a/docs/framework-conventions.md b/docs/framework-conventions.md
index 8166ccafc..f4a5b84cf 100644
--- a/docs/framework-conventions.md
+++ b/docs/framework-conventions.md
@@ -476,6 +476,14 @@ Only fetch directives are extendable (`style-src`, `font-src`, `img-src`,
 `frame-ancestors`, which belong to the host operator. Sources are validated
 single tokens; an invalid declaration raises at boot.
 
+Production script directives use a per-request nonce and `strict-dynamic`.
+In CSP3 browsers, script host allowlists are ignored: executable scripts in
+custom templates must carry `nonce="{{ request.state.csp_nonce }}"`, including
+external script entries. The Inertia adapter adds it to its module scripts;
+imports loaded by those trusted entries inherit trust. Registered script
+origins remain in the policy for older browsers; other asset directives
+continue to use their allowlists. See [security headers](framework/middleware.md#securityheadersmiddleware).
+
 ### CSRF (opt-in token check)
 
 The framework baseline is `SameSite=Lax` on the session cookie. Modules that
diff --git a/docs/framework/lifecycle.md b/docs/framework/lifecycle.md
index a88b8cee3..8b1aff777 100644
--- a/docs/framework/lifecycle.md
+++ b/docs/framework/lifecycle.md
@@ -224,6 +224,14 @@ can be extended — never `default-src`, `base-uri`, `form-action`, or
 single origin/scheme token; invalid declarations raise at boot. The origins
 land in both the development (Vite-widened) and production policies.
 
+Production script directives use a per-request nonce and `strict-dynamic`.
+In CSP3 browsers, script host allowlists are ignored: executable scripts in
+custom templates must carry `nonce="{{ request.state.csp_nonce }}"`, including
+external script entries. The Inertia adapter adds it to its module scripts;
+imports loaded by those trusted entries inherit trust. Registered script
+origins remain in the policy for older browsers; other asset directives
+continue to use their allowlists. See [security headers](middleware.md#securityheadersmiddleware).
+
 The hook runs before DB-backed settings are hydrated, so an origin that comes
 from a setting can't be a static `add()`. Register a provider instead — it is
 called on every response with the app and returns `(directive, source)` pairs:
@@ -238,7 +246,8 @@ Providers must be synchronous and read only in-memory state
 same validation as `add()`; a provider that raises, or an invalid pair, is
 logged once and dropped — the static policy still applies. The finished policy
 is cached by the pairs returned, so a settings edit takes effect on the next
-response. With no providers the header is the precomputed boot-time string.
+response. With no providers the base policy is precomputed at boot; the request nonce
+is inserted afterwards, outside the provider cache.
 
 ## `register_exception_handlers(app)`
 
diff --git a/docs/framework/middleware.md b/docs/framework/middleware.md
index 422de5002..6faf4f00c 100644
--- a/docs/framework/middleware.md
+++ b/docs/framework/middleware.md
@@ -155,7 +155,21 @@ It runs at `COMPRESSION_LEVEL` 5, not Starlette's default of 9. Compression runs
 
 ### `SecurityHeadersMiddleware`
 
-Sets conservative defaults: `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`, `X-Frame-Options: SAMEORIGIN`, `X-XSS-Protection: 0` (the legacy auditor is disabled in favour of CSP), plus a default CSP and — outside development — HSTS. In development the CSP is widened for the Vite dev origin and HSTS is suppressed. Modules that load assets from an external origin extend the policy through the [`register_csp_sources`](lifecycle.md#register_csp_sourcesregistry) hook; both the dev and production variants honor those origins. Override on a per-route basis with your own response headers.
+Sets conservative defaults: `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`, `X-Frame-Options: SAMEORIGIN`, `X-XSS-Protection: 0` (the legacy auditor is disabled in favour of CSP), plus a default CSP and — outside development — HSTS. In development the CSP is widened for the Vite dev origin and HSTS is suppressed. Modules that load assets from an external origin extend the policy through the [`register_csp_sources`](lifecycle.md#register_csp_sourcesregistry) hook; both the dev and production variants include those origins.
+
+Outside development, `script-src` and `script-src-elem` use
+`'self' 'nonce-<request nonce>' 'strict-dynamic'`, without `'unsafe-inline'` or
+`'unsafe-eval'`. Each HTTP request gets `request.state.csp_nonce`. The host's
+pre-paint script and Inertia's module entry carry that nonce; custom templates
+must put `nonce="{{ request.state.csp_nonce }}"` on every executable script,
+including external entries. JSON page data and JSON-LD are inert and need no
+nonce. Development retains the permissive Vite/HMR policy.
+
+CSP3 browsers ignore script host allowlists under `strict-dynamic`; a nonced
+entry can load its imports. Module sources are retained for older browsers
+and other fetch directives. A response CSP containing `sandbox` is emitted
+as a separate header alongside the app policy, so browsers enforce their
+intersection. Other response CSPs are overwritten by the app policy.
 
 ### `SessionMiddleware`
 
diff --git a/docs/framework/spa-mounts.md b/docs/framework/spa-mounts.md
index 1330d3242..32f49ba61 100644
--- a/docs/framework/spa-mounts.md
+++ b/docs/framework/spa-mounts.md
@@ -39,7 +39,13 @@ with a warning.
 an anonymous visitor is redirected to login. `auth="public"` registers the prefix
 in the [public route registry](/framework/public-routes) for `GET`/`HEAD` only.
 CSP applies as for any response; whitelist external origins the SPA needs with
-`register_csp_sources`.
+`register_csp_sources`. In production the script policy is
+`'nonce-<request nonce>' 'strict-dynamic'`, under which CSP3 browsers ignore
+origin allowlists, so the mount stamps the request nonce onto every `<script>`
+tag of the shell's `index.html` as it serves it (an existing `nonce=` is kept)
+and drops the shell's `ETag`/`Last-Modified`, because a revalidated copy would
+carry a stale nonce. Scripts the shell's entry loads are trusted through
+`'strict-dynamic'`. Development retains the permissive Vite policy.
 
 ## Boot check
 
diff --git a/docs/module-authoring.md b/docs/module-authoring.md
index 6ab9c0057..2147c79db 100644
--- a/docs/module-authoring.md
+++ b/docs/module-authoring.md
@@ -612,6 +612,14 @@ def register_csp_sources(self, registry):
 Only fetch directives can be extended; each source must be a single
 origin/scheme token, validated at boot.
 
+Production script directives use a per-request nonce and `strict-dynamic`.
+In CSP3 browsers, script host allowlists are ignored: executable scripts in
+custom templates must carry `nonce="{{ request.state.csp_nonce }}"`, including
+external script entries. The Inertia adapter adds it to its module scripts;
+imports loaded by those trusted entries inherit trust. Registered script
+origins remain in the policy for older browsers; other asset directives
+continue to use their allowlists. See [security headers](framework/middleware.md#securityheadersmiddleware).
+
 An origin that comes from a DB-backed setting (a configurable tile server)
 can't be added at boot — the hook runs before settings hydrate. Register a
 provider, evaluated per response:
diff --git a/docs/modules/file_storage.md b/docs/modules/file_storage.md
index 6fbae40b3..e61262ebe 100644
--- a/docs/modules/file_storage.md
+++ b/docs/modules/file_storage.md
@@ -103,7 +103,8 @@ Serving rules:
   `If-None-Match`) and `X-Content-Type-Options: nosniff`.
 - Every public response carries `Content-Security-Policy: default-src 'none';
   style-src 'unsafe-inline'; sandbox` (the security-headers middleware now
-  keeps a CSP the response already set). Only an allow-list of types is
+  emits it alongside the app policy as a second header, enforcing their
+  intersection). Only an allow-list of types is
   served `inline` (and redirected on S3): common raster images, PDF, JSON,
   GeoJSON, plain text, CSV, opaque binaries (`application/octet-stream`, zip,
   gzip, protobuf / vector tiles) and `audio/*` / `video/*` / `font/*` minus
diff --git a/framework/cli/simple_module_cli/templates/host/templates/index.html b/framework/cli/simple_module_cli/templates/host/templates/index.html
index 5ef0da519..dd3788636 100644
--- a/framework/cli/simple_module_cli/templates/host/templates/index.html
+++ b/framework/cli/simple_module_cli/templates/host/templates/index.html
@@ -15,7 +15,7 @@
     <link href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Outfit:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
     {% inertia_head %}
     {% if request.app.state.sm.inertia_config.environment == "development" %}
-    <script type="module">
+    <script type="module" nonce="{{ request.state.csp_nonce }}">
       import RefreshRuntime from "{{ request.app.state.sm.inertia_config.dev_url }}/@react-refresh";
       RefreshRuntime.injectIntoGlobalHook(window);
       window.$RefreshReg$ = () => {};
diff --git a/framework/hosting/simple_module_hosting/_spa_mount.py b/framework/hosting/simple_module_hosting/_spa_mount.py
index 7ee75ff43..9de3fc6af 100644
--- a/framework/hosting/simple_module_hosting/_spa_mount.py
+++ b/framework/hosting/simple_module_hosting/_spa_mount.py
@@ -15,6 +15,7 @@
 
 import logging
 import re
+from pathlib import Path
 
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
@@ -23,7 +24,7 @@
 from simple_module_core.spa_mount import SPA_AUTH_PUBLIC, SpaMount
 from starlette.datastructures import Headers
 from starlette.exceptions import HTTPException
-from starlette.responses import Response
+from starlette.responses import FileResponse, Response
 from starlette.types import Scope
 
 from simple_module_hosting._route_paths import app_route_paths
@@ -37,6 +38,9 @@
 _NO_CACHE = "no-cache"
 _CACHE_CONTROL = "Cache-Control"
 # Vite/webpack content-hashed file: `index-3f9a8c21.js`, `chunk.AbC123xy.css`.
+# Set by SecurityHeadersMiddleware for every HTTP request.
+_NONCE_STATE_KEY = "csp_nonce"
+_SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\bnonce=)", re.IGNORECASE)
 _HASHED_FILE = re.compile(r"[-.]([A-Za-z0-9_-]{8,})\.[A-Za-z0-9]+$")
 _PRIVATE_IMMUTABLE = "private, max-age=31536000, immutable"
 _PRIVATE_NO_CACHE = "private, no-cache"
@@ -91,11 +95,32 @@ async def get_response(self, path: str, scope: Scope) -> Response:
 
     async def _index_response(self, scope: Scope) -> Response:
         response = await super().get_response(self._index, scope)
+        nonce = (scope.get("state") or {}).get(_NONCE_STATE_KEY)
+        if nonce and isinstance(response, FileResponse) and response.status_code == _OK:
+            response = _with_script_nonce(response, nonce)
         # The shell references hashed bundles, so it must revalidate on each visit.
         response.headers[_CACHE_CONTROL] = _NO_CACHE if self._public else _PRIVATE_NO_CACHE
         return response
 
 
+def _with_script_nonce(response: FileResponse, nonce: str) -> Response:
+    """The shell with the request's CSP nonce on every ``<script>`` tag.
+
+    The production script policy is ``'nonce-…' 'strict-dynamic'``, under which a
+    CSP3 browser ignores ``'self'``: a static shell's own entry script would be
+    blocked. The nonce differs per response, so the validators go too: a 304
+    would revive a cached shell whose nonce no longer matches the header.
+    """
+    html = Path(response.path).read_text(encoding="utf-8")
+    html = _SCRIPT_WITHOUT_NONCE.sub(f'<script nonce="{nonce}"', html)
+    headers = {
+        k: v
+        for k, v in response.headers.items()
+        if k.lower() not in ("content-length", "etag", "last-modified")
+    }
+    return Response(html, status_code=_OK, headers=headers, media_type="text/html")
+
+
 def _is_page_request(path: str, scope: Scope) -> bool:
     if _LOOKS_LIKE_FILE.search(path.rsplit("/", 1)[-1]):
         return False
diff --git a/framework/hosting/simple_module_hosting/log_sinks.py b/framework/hosting/simple_module_hosting/log_sinks.py
index d6f6ee9fe..ba775b4fd 100644
--- a/framework/hosting/simple_module_hosting/log_sinks.py
+++ b/framework/hosting/simple_module_hosting/log_sinks.py
@@ -70,8 +70,12 @@ def redact_record(record: logging.LogRecord) -> None:
     """Mask ``record`` in place: the message, the traceback text and any extra attributes."""
     record.msg = redact(record.getMessage())
     record.args = None
+    if record.exc_info and not record.exc_text:
+        record.exc_text = logging.Formatter().formatException(record.exc_info)
     if record.exc_text:
         record.exc_text = redact(record.exc_text)
+    if record.stack_info:
+        record.stack_info = redact(record.stack_info)
     for key, value in list(standard_extra_attrs(record).items()):
         if is_sensitive_key(key):
             record.__dict__[key] = REDACTED
diff --git a/framework/hosting/simple_module_hosting/middleware.py b/framework/hosting/simple_module_hosting/middleware.py
index 48955232e..1debf8ada 100644
--- a/framework/hosting/simple_module_hosting/middleware.py
+++ b/framework/hosting/simple_module_hosting/middleware.py
@@ -10,6 +10,7 @@
 from __future__ import annotations
 
 import logging
+import secrets
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any
 
@@ -63,7 +64,7 @@
 _XFO_SAMEORIGIN = "SAMEORIGIN"
 # OWASP/MDN now recommend disabling the legacy XSS auditor — older
 # browser implementations introduced reflected-XSS vectors of their own.
-# Modern protection comes from the CSP below (strict-dynamic + nonces).
+# Production CSP authorizes scripts with a per-request nonce.
 _XXSS_DISABLED = "0"
 _REFERRER_STRICT_ORIGIN = "strict-origin-when-cross-origin"
 
@@ -90,12 +91,9 @@ class SecurityHeadersMiddleware:
 
     DEFAULT_CSP = (
         "default-src 'self'; "
-        # Inertia embeds the initial page blob inline; Vite injects a React
-        # Refresh shim at boot. Both require 'unsafe-inline' for scripts.
-        # Production builds compile to hashed bundles, so this can be
-        # tightened with a nonce once Vite's preamble is removed in prod.
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
-        "script-src-elem 'self' 'unsafe-inline'; "
+        # The request nonce is inserted after static/dynamic sources are merged.
+        "script-src 'self' 'strict-dynamic'; "
+        "script-src-elem 'self' 'strict-dynamic'; "
         "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
         "img-src 'self' data: blob:; "
         "font-src 'self' https://fonts.gstatic.com data:; "
@@ -161,6 +159,9 @@ async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
             await self.app(scope, receive, send)
             return
 
+        nonce = secrets.token_urlsafe(16)
+        scope.setdefault("state", {})["csp_nonce"] = nonce
+
         async def send_with_headers(message: Message) -> None:
             if message["type"] == _MSG_RESPONSE_START:
                 headers = MutableHeaders(scope=message)
@@ -168,15 +169,20 @@ async def send_with_headers(message: Message) -> None:
                 headers[_HEADER_X_FRAME_OPTIONS] = _XFO_SAMEORIGIN
                 headers[_HEADER_X_XSS_PROTECTION] = _XXSS_DISABLED
                 headers[_HEADER_REFERRER_POLICY] = _REFERRER_STRICT_ORIGIN
-                # A response may only *tighten* the app-wide policy: one that
-                # carries its own ``sandbox`` directive (file_storage serving
-                # user-uploaded bytes) keeps it. Any other response-supplied
-                # policy is overwritten, so a module cannot weaken the default.
+                # Separate policies intersect: sandbox responses cannot replace
+                # the app's default-src, frame-ancestors or other protections.
                 own = headers.get(_HEADER_CSP) or ""
-                keeps_own = "sandbox" in {d.strip().split(" ")[0].lower() for d in own.split(";")}
-                if self.csp and not keeps_own:
+                keeps_own = any(
+                    d.split() and d.split()[0].lower() == "sandbox" for d in own.split(";")
+                )
+                if self.csp:
                     dyn = self._dynamic
-                    headers[_HEADER_CSP] = dyn.policy_for(scope.get("app")) if dyn else self.csp
+                    policy = dyn.policy_for(scope.get("app")) if dyn else self.csp
+                    policy = policy.replace("'strict-dynamic'", f"'nonce-{nonce}' 'strict-dynamic'")
+                    if keeps_own:
+                        headers.append(_HEADER_CSP, policy)
+                    else:
+                        headers[_HEADER_CSP] = policy
                 if self.hsts:
                     headers[_HEADER_HSTS] = self.hsts
             await send(message)
diff --git a/framework/hosting/tests/test_hosting_csp_nonce.py b/framework/hosting/tests/test_hosting_csp_nonce.py
new file mode 100644
index 000000000..60f751ab1
--- /dev/null
+++ b/framework/hosting/tests/test_hosting_csp_nonce.py
@@ -0,0 +1,120 @@
+"""Nonce-bearing scripts and intersecting response policies (#785)."""
+
+from html.parser import HTMLParser
+from pathlib import Path
+from types import SimpleNamespace
+
+import httpx
+import pytest
+from jinja2 import Environment, FileSystemLoader
+from simple_module_core.csp import CspSourceRegistry
+from simple_module_hosting.middleware import SecurityHeadersMiddleware
+from simple_module_inertia.templating import InertiaContext, InertiaExtension
+from starlette.applications import Starlette
+from starlette.responses import HTMLResponse, PlainTextResponse
+from starlette.routing import Route
+
+_ROOT = Path(__file__).resolve().parents[3]
+_TEMPLATES = [
+    _ROOT / "host/templates",
+    _ROOT / "framework/cli/simple_module_cli/templates/host/templates",
+]
+_CSP = "content-security-policy"
+
+
+class Scripts(HTMLParser):
+    def __init__(self, html):
+        super().__init__()
+        self.scripts = []
+        self.feed(html)
+
+    def handle_starttag(self, tag, attrs):
+        if tag == "script":
+            self.scripts.append(dict(attrs))
+
+
+@pytest.mark.parametrize("template_dir", _TEMPLATES, ids=["host", "scaffold"])
+@pytest.mark.parametrize("environment", ["production", "development"])
+async def test_scripts_share_the_request_nonce(template_dir, environment):
+    env = Environment(
+        loader=FileSystemLoader(template_dir), extensions=[InertiaExtension], autoescape=True
+    )
+    env.globals["branding_head"] = lambda request: SimpleNamespace(
+        app_name="Test", theme_color="", favicon_url=""
+    )
+    config = SimpleNamespace(environment=environment, dev_url="http://localhost:5050")
+
+    async def page(request):
+        return HTMLResponse(
+            env.get_template("index.html").render(
+                request=request,
+                inertia=InertiaContext(
+                    environment=environment,
+                    dev_url=config.dev_url,
+                    css=[],
+                    js="/static/app.js",
+                    is_ssr=False,
+                    data="{}",
+                ),
+            )
+        )
+
+    app = Starlette(routes=[Route("/", page)])
+    app.state.sm = SimpleNamespace(inertia_config=config)
+    registry = CspSourceRegistry()
+    registry.add("script-src", "https://scripts.example")
+    registry.add_provider(lambda app: [("script-src", "https://dynamic.example")])
+    app.add_middleware(
+        SecurityHeadersMiddleware,
+        content_security_policy=registry.extend_policy(
+            SecurityHeadersMiddleware.dev_csp(config.dev_url)
+            if environment == "development"
+            else SecurityHeadersMiddleware.DEFAULT_CSP
+        ),
+        csp_registry=registry,
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        first, second = await client.get("/"), await client.get("/")
+    scripts = Scripts(first.text).scripts
+    executable = [s for s in scripts if s.get("type") != "application/json"]
+    nonce = executable[0].get("nonce")
+    assert nonce
+    assert all(s.get("nonce") == nonce for s in executable)
+    assert Scripts(second.text).scripts[-1]["nonce"] != nonce
+    csp = first.headers[_CSP]
+    assert "https://scripts.example" in csp
+    assert "https://dynamic.example" in csp
+    if environment == "production":
+        for directive in ("script-src", "script-src-elem"):
+            assert f"{directive} 'self' 'nonce-{nonce}' 'strict-dynamic'" in csp
+        assert "'unsafe-eval'" not in csp
+        assert "'unsafe-inline'" not in csp.split("style-src")[0]
+    else:
+        assert "'unsafe-eval'" in csp and "'unsafe-inline'" in csp
+        assert config.dev_url in csp
+        assert any(s.get("src", "").endswith("/@vite/client") for s in scripts)
+
+
+@pytest.mark.parametrize("own", ["sandbox allow-scripts; script-src *", "SANDBOX\tallow-scripts"])
+async def test_sandbox_response_keeps_both_policies(own):
+    async def page(request):
+        return PlainTextResponse("ok", headers={_CSP: own})
+
+    app = SecurityHeadersMiddleware(Starlette(routes=[Route("/", page)]))
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        response = await client.get("/")
+    policies = response.headers.get_list(_CSP)
+    assert len(policies) == 2
+    assert own in policies
+    app_policy = next(policy for policy in policies if policy != own)
+    for directive in (
+        "frame-ancestors 'self'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "default-src 'self'",
+    ):
+        assert directive in app_policy
diff --git a/framework/hosting/tests/test_csp_providers.py b/framework/hosting/tests/test_hosting_csp_providers.py
similarity index 97%
rename from framework/hosting/tests/test_csp_providers.py
rename to framework/hosting/tests/test_hosting_csp_providers.py
index f2033243b..1497e0fbd 100644
--- a/framework/hosting/tests/test_csp_providers.py
+++ b/framework/hosting/tests/test_hosting_csp_providers.py
@@ -8,6 +8,7 @@
 from __future__ import annotations
 
 import logging
+import re
 from types import SimpleNamespace
 
 import httpx
@@ -50,7 +51,8 @@ async def _csp(app, path: str = "/health/live") -> str:
     transport = httpx.ASGITransport(app=app)
     async with httpx.AsyncClient(transport=transport, base_url="http://testserver") as c:
         resp = await c.get(path)
-    return resp.headers[_CSP]
+    # Compare the policy structure independently of the per-request nonce.
+    return re.sub(r"'nonce-[^']+' ", "", resp.headers[_CSP])
 
 
 class TestThroughCreateApp:
diff --git a/framework/hosting/tests/test_hosting_log_sinks.py b/framework/hosting/tests/test_hosting_log_sinks.py
index 953721b48..f54bbcf10 100644
--- a/framework/hosting/tests/test_hosting_log_sinks.py
+++ b/framework/hosting/tests/test_hosting_log_sinks.py
@@ -207,3 +207,40 @@ def test_structured_extras_are_scrubbed_recursively() -> None:
     assert "abc" not in dumped
     assert record.payload["ok"] == "fine"
     assert original["password"] == "hunter2"  # the caller's object is untouched
+
+
+@pytest.mark.parametrize("cached_traceback", [False, True])
+def test_plain_handler_redacts_traceback_and_stack(target, cached_traceback):
+    import io
+    import sys
+
+    from simple_module_hosting.log_sinks import RedactionFilter
+
+    out = io.StringIO()
+    handler = logging.StreamHandler(out)
+    handler.addFilter(RedactionFilter())
+    target.addHandler(handler)
+    try:
+        raise RuntimeError("connect failed password=hunter2")
+    except RuntimeError:
+        record = target.makeRecord(
+            target.name,
+            logging.ERROR,
+            __file__,
+            1,
+            "boom secret=s3cr3t",
+            (),
+            sys.exc_info(),
+            sinfo="Stack (most recent call last):\npassword=stacksecret",
+        )
+    if cached_traceback:
+        record.exc_text = logging.Formatter().formatException(record.exc_info)
+    target.handle(record)
+    rendered = out.getvalue()
+    assert "hunter2" not in rendered
+    assert "s3cr3t" not in rendered
+    assert "stacksecret" not in rendered
+    assert "Traceback (most recent call last)" in rendered
+    assert f"RuntimeError: connect failed password={REDACTED}" in rendered
+    assert f"boom secret={REDACTED}" in rendered
+    assert f"password={REDACTED}" in rendered
diff --git a/framework/hosting/tests/test_hosting_spa_mount_nonce.py b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
new file mode 100644
index 000000000..6bed8261f
--- /dev/null
+++ b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
@@ -0,0 +1,44 @@
+"""A static SPA shell gets the request's CSP nonce on its script tags (#785).
+
+The production script policy is ``'nonce-…' 'strict-dynamic'``; a CSP3 browser
+then ignores ``'self'``, so a shell served byte-for-byte could not run its own
+entry script.
+"""
+
+from __future__ import annotations
+
+from simple_module_hosting._spa_mount import SpaStaticFiles
+
+_SHELL = (
+    '<html><head><script type="module" src="/legacy/assets/index-3f9a8c21b.js"></script>'
+    '<script nonce="kept">window.a = 1</script></head><body></body></html>'
+)
+
+
+def _scope(nonce: str | None) -> dict:
+    state = {"csp_nonce": nonce} if nonce else {}
+    return {"type": "http", "method": "GET", "path": "/", "headers": [], "state": state}
+
+
+async def test_index_scripts_carry_the_request_nonce(tmp_path) -> None:
+    (tmp_path / "index.html").write_text(_SHELL, encoding="utf-8")
+    spa = SpaStaticFiles(directory=tmp_path, index="index.html")
+
+    response = await spa.get_response("", _scope("abc123"))
+
+    body = response.body.decode()
+    assert '<script nonce="abc123" type="module" src="/legacy/assets/' in body
+    assert '<script nonce="kept">' in body  # an author's own nonce is left alone
+    # The nonce changes per response, so no validator may revive an old shell.
+    assert "etag" not in response.headers
+    assert "last-modified" not in response.headers
+    assert response.headers["content-type"].startswith("text/html")
+
+
+async def test_without_a_nonce_the_shell_is_served_unchanged(tmp_path) -> None:
+    (tmp_path / "index.html").write_text(_SHELL, encoding="utf-8")
+    spa = SpaStaticFiles(directory=tmp_path, index="index.html")
+
+    response = await spa.get_response("", _scope(None))
+
+    assert "etag" in response.headers  # still the plain FileResponse
diff --git a/framework/inertia/simple_module_inertia/templating.py b/framework/inertia/simple_module_inertia/templating.py
index 112f2b3de..be4db082c 100644
--- a/framework/inertia/simple_module_inertia/templating.py
+++ b/framework/inertia/simple_module_inertia/templating.py
@@ -13,7 +13,7 @@
 from jinja2.ext import Extension
 from jinja2.parser import Parser
 from jinja2.runtime import Context
-from markupsafe import Markup
+from markupsafe import Markup, escape
 
 
 @dataclass
@@ -41,10 +41,13 @@ def parse(self, parser: Parser) -> nodes.Node:
 
     def _render_inertia_head(self, context: Context) -> Markup:
         inertia: InertiaContext = context["inertia"]
+        request = context.get("request")
+        nonce = getattr(request.state, "csp_nonce", "") if request is not None else ""
+        nonce_attr = f' nonce="{escape(nonce)}"' if nonce else ""
         fragments: list[str] = []
         if inertia.environment == "development":
             fragments.append(
-                f'<script type="module" src="{inertia.dev_url}/@vite/client"></script>'
+                f'<script type="module" src="{inertia.dev_url}/@vite/client"{nonce_attr}></script>'
             )
         if inertia.is_ssr:
             if inertia.ssr_head is None:
@@ -56,6 +59,9 @@ def _render_inertia_head(self, context: Context) -> Markup:
 
     def _render_inertia_body(self, context: Context) -> Markup:
         inertia: InertiaContext = context["inertia"]
+        request = context.get("request")
+        nonce = getattr(request.state, "csp_nonce", "") if request is not None else ""
+        nonce_attr = f' nonce="{escape(nonce)}"' if nonce else ""
         fragments: list[str] = []
         if inertia.is_ssr:
             if inertia.ssr_body is None:
@@ -69,5 +75,5 @@ def _render_inertia_body(self, context: Context) -> Markup:
                 f'<script data-page="app" type="application/json">{inertia.data}</script>'
             )
             fragments.append('<div id="app"></div>')
-        fragments.append(f'<script type="module" src="{inertia.js}"></script>')
+        fragments.append(f'<script type="module" src="{inertia.js}"{nonce_attr}></script>')
         return Markup("\n".join(fragments))
diff --git a/host/templates/index.html b/host/templates/index.html
index 5fb91771a..83fc682d0 100644
--- a/host/templates/index.html
+++ b/host/templates/index.html
@@ -13,11 +13,9 @@
        React mounts, so a dark-mode user saw a white page for the length of the
        bundle download. Reads the same `sm.theme` key `theme.ts` writes and
        applies the same rule; `theme.ts` stays the source of truth for every
-       later change, including the OS flipping at sunset. Inline is allowed
-       here — the CSP in `middleware.py` carries 'unsafe-inline' for scripts
-       (Vite's preamble needs it); tightening it to a nonce is a change to make
-       there and here together. #}
-    <script>
+       later change, including the OS flipping at sunset. The per-request
+       CSP nonce authorizes this pre-paint script in production. #}
+    <script nonce="{{ request.state.csp_nonce }}">
       (function () {
         try {
           var pref = window.localStorage.getItem('sm.theme');
@@ -44,7 +42,7 @@
     <link href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Sora:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet" />
     {% inertia_head %}
     {% if request.app.state.sm.inertia_config.environment == "development" %}
-    <script type="module">
+    <script type="module" nonce="{{ request.state.csp_nonce }}">
       import RefreshRuntime from "{{ request.app.state.sm.inertia_config.dev_url }}/@react-refresh";
       RefreshRuntime.injectIntoGlobalHook(window);
       window.$RefreshReg$ = () => {};
diff --git a/modules/file_storage/tests/test_file_storage_p3_download_csp.py b/modules/file_storage/tests/test_file_storage_p3_download_csp.py
index e5cdb29c3..1cb7949f8 100644
--- a/modules/file_storage/tests/test_file_storage_p3_download_csp.py
+++ b/modules/file_storage/tests/test_file_storage_p3_download_csp.py
@@ -13,7 +13,7 @@ async def test_streamed_download_is_sandboxed(self, tenant_client):
             resp = await a.client.get(f"{API}/files/{file_id}/download")
 
             assert resp.status_code == 200
-            assert resp.headers["content-security-policy"] == constants.PUBLIC_CSP
+            assert constants.PUBLIC_CSP in resp.headers.get_list("content-security-policy")
             assert resp.headers["x-content-type-options"] == "nosniff"
             assert "attachment" in resp.headers["content-disposition"]
 
@@ -31,4 +31,4 @@ async def test_thumbnail_keeps_the_sandbox_csp(self, tenant_client):
             file_id = resp.json()["id"]
             thumb = await a.client.get(f"{API}/files/{file_id}/thumbnail")
             assert thumb.status_code == 200
-            assert thumb.headers["content-security-policy"] == constants.PUBLIC_CSP
+            assert constants.PUBLIC_CSP in thumb.headers.get_list("content-security-policy")

From 624922130f45e80a03f098dab265d2b72b106512 Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Tue, 3 Nov 2026 21:04:44 +0100
Subject: [PATCH 2/5] refactor(optimize): one nonce-attribute helper; sandbox
 check only when a CSP is set; comment placement

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 .../hosting/simple_module_hosting/_spa_mount.py   |  2 +-
 .../hosting/simple_module_hosting/middleware.py   | 10 ++++------
 .../inertia/simple_module_inertia/templating.py   | 15 +++++++++------
 3 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/framework/hosting/simple_module_hosting/_spa_mount.py b/framework/hosting/simple_module_hosting/_spa_mount.py
index 9de3fc6af..4ba66c4fa 100644
--- a/framework/hosting/simple_module_hosting/_spa_mount.py
+++ b/framework/hosting/simple_module_hosting/_spa_mount.py
@@ -37,10 +37,10 @@
 _SAFE_METHODS = ("GET", "HEAD")
 _NO_CACHE = "no-cache"
 _CACHE_CONTROL = "Cache-Control"
-# Vite/webpack content-hashed file: `index-3f9a8c21.js`, `chunk.AbC123xy.css`.
 # Set by SecurityHeadersMiddleware for every HTTP request.
 _NONCE_STATE_KEY = "csp_nonce"
 _SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\bnonce=)", re.IGNORECASE)
+# Vite/webpack content-hashed file: `index-3f9a8c21.js`, `chunk.AbC123xy.css`.
 _HASHED_FILE = re.compile(r"[-.]([A-Za-z0-9_-]{8,})\.[A-Za-z0-9]+$")
 _PRIVATE_IMMUTABLE = "private, max-age=31536000, immutable"
 _PRIVATE_NO_CACHE = "private, no-cache"
diff --git a/framework/hosting/simple_module_hosting/middleware.py b/framework/hosting/simple_module_hosting/middleware.py
index 1debf8ada..7f913e062 100644
--- a/framework/hosting/simple_module_hosting/middleware.py
+++ b/framework/hosting/simple_module_hosting/middleware.py
@@ -169,13 +169,11 @@ async def send_with_headers(message: Message) -> None:
                 headers[_HEADER_X_FRAME_OPTIONS] = _XFO_SAMEORIGIN
                 headers[_HEADER_X_XSS_PROTECTION] = _XXSS_DISABLED
                 headers[_HEADER_REFERRER_POLICY] = _REFERRER_STRICT_ORIGIN
-                # Separate policies intersect: sandbox responses cannot replace
-                # the app's default-src, frame-ancestors or other protections.
-                own = headers.get(_HEADER_CSP) or ""
-                keeps_own = any(
-                    d.split() and d.split()[0].lower() == "sandbox" for d in own.split(";")
-                )
                 if self.csp:
+                    # Separate policies intersect: sandbox responses cannot replace
+                    # the app's default-src, frame-ancestors or other protections.
+                    own = (headers.get(_HEADER_CSP) or "").lower()
+                    keeps_own = any(d.split()[:1] == ["sandbox"] for d in own.split(";"))
                     dyn = self._dynamic
                     policy = dyn.policy_for(scope.get("app")) if dyn else self.csp
                     policy = policy.replace("'strict-dynamic'", f"'nonce-{nonce}' 'strict-dynamic'")
diff --git a/framework/inertia/simple_module_inertia/templating.py b/framework/inertia/simple_module_inertia/templating.py
index be4db082c..19f3a4d6c 100644
--- a/framework/inertia/simple_module_inertia/templating.py
+++ b/framework/inertia/simple_module_inertia/templating.py
@@ -16,6 +16,13 @@
 from markupsafe import Markup, escape
 
 
+def _nonce_attr(context: Context) -> str:
+    """`` nonce="…"`` for the request's CSP nonce, or ``""`` when it has none."""
+    request = context.get("request")
+    nonce = getattr(request.state, "csp_nonce", "") if request is not None else ""
+    return f' nonce="{escape(nonce)}"' if nonce else ""
+
+
 @dataclass
 class InertiaContext:
     environment: Literal["development", "production"]
@@ -41,9 +48,7 @@ def parse(self, parser: Parser) -> nodes.Node:
 
     def _render_inertia_head(self, context: Context) -> Markup:
         inertia: InertiaContext = context["inertia"]
-        request = context.get("request")
-        nonce = getattr(request.state, "csp_nonce", "") if request is not None else ""
-        nonce_attr = f' nonce="{escape(nonce)}"' if nonce else ""
+        nonce_attr = _nonce_attr(context)
         fragments: list[str] = []
         if inertia.environment == "development":
             fragments.append(
@@ -59,9 +64,7 @@ def _render_inertia_head(self, context: Context) -> Markup:
 
     def _render_inertia_body(self, context: Context) -> Markup:
         inertia: InertiaContext = context["inertia"]
-        request = context.get("request")
-        nonce = getattr(request.state, "csp_nonce", "") if request is not None else ""
-        nonce_attr = f' nonce="{escape(nonce)}"' if nonce else ""
+        nonce_attr = _nonce_attr(context)
         fragments: list[str] = []
         if inertia.is_ssr:
             if inertia.ssr_body is None:

From b67e2b0c4c220d09fad445cc5a116db0bd4ff97e Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Tue, 3 Nov 2026 21:11:22 +0100
Subject: [PATCH 3/5] fix: address code review findings (round 1, pass 1)

- 'wasm-unsafe-eval' keeps WebAssembly compiling under the nonce policy
- 304 responses carry no CSP, so a cached document keeps its matching nonce
- SPA shell read off the event loop; conditional requests get a fresh shell;
  nonce detection needs a real attribute
- CHANGELOG: CSP change under Changed with upgrade notes; sandbox framing impact

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 CHANGELOG.md                                  | 21 +++++++++++++------
 .../simple_module_hosting/_spa_mount.py       | 14 ++++++++++---
 .../simple_module_hosting/middleware.py       |  9 ++++++--
 .../hosting/tests/test_hosting_csp_nonce.py   | 18 ++++++++++++++++
 .../tests/test_hosting_spa_mount_nonce.py     | 13 ++++++++++++
 5 files changed, 64 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 417130648..5ba3f6a11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,21 @@ All notable changes to this project are documented in this file. The format is b
 ## [Unreleased]
 
 ### Changed
+- **Breaking (production CSP, #785):** `script-src`/`script-src-elem` are now
+  `'self' 'nonce-<per-request>' 'strict-dynamic'` (plus `'wasm-unsafe-eval'`
+  for WebAssembly) instead of `'unsafe-inline' 'unsafe-eval'`. The host and
+  scaffolded templates, the Inertia entry tags and SPA-mount shells carry the
+  nonce. Upgrade: custom templates must put
+  `nonce="{{ request.state.csp_nonce }}"` on every executable `<script>`
+  (inline or external); inline event handlers (`onclick=`), `eval`/`new
+  Function` and scripts injected without a nonce-bearing parent no longer run;
+  a module that set its own `content_security_policy` should keep the nonce
+  token. Development keeps the permissive Vite policy. A 304 carries no CSP
+  header, so a cached document keeps the policy its nonce matches.
+- **Behaviour change (#785):** a response CSP containing `sandbox` (file_storage
+  downloads) is sent beside the app policy, so browsers enforce both: such
+  responses now also get the app's `frame-ancestors 'self'`, so they cannot be
+  framed by other origins.
 - `simple_module_hosting[redis]` and `simple_module_background_tasks` accept
   `redis` 7 and 8 (`redis>=5,<9`); the lockfile moves to redis 8.1.0 with
   kombu 5.7.0, the first stable kombu that supports it (#665).
@@ -31,12 +46,6 @@ All notable changes to this project are documented in this file. The format is b
   `account` or whose `azp` is another client (only `oidc` pins both).
 
 ### Fixed
-- **Behaviour change:** production scripts require a per-request CSP nonce and
-  use `strict-dynamic`, without script `unsafe-inline` or `unsafe-eval`.
-  The host/scaffold templates and Inertia entry scripts carry the nonce;
-  custom templates must add `request.state.csp_nonce` to executable scripts,
-  and static SPA shells need nonce-aware HTML serving.
-  Sandbox response policies are enforced alongside the app CSP (#785).
 - **Behaviour change:** `RedactionFilter` on ordinary logging handlers masks
   secrets in tracebacks and stack information, including exception text not
   yet formatted when the filter runs (#789).
diff --git a/framework/hosting/simple_module_hosting/_spa_mount.py b/framework/hosting/simple_module_hosting/_spa_mount.py
index 4ba66c4fa..af77f1e07 100644
--- a/framework/hosting/simple_module_hosting/_spa_mount.py
+++ b/framework/hosting/simple_module_hosting/_spa_mount.py
@@ -17,6 +17,7 @@
 import re
 from pathlib import Path
 
+import anyio
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
 from simple_module_core.app_state import get_host_services, get_public_routes, get_spa_prefixes
@@ -39,7 +40,8 @@
 _CACHE_CONTROL = "Cache-Control"
 # Set by SecurityHeadersMiddleware for every HTTP request.
 _NONCE_STATE_KEY = "csp_nonce"
-_SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\bnonce=)", re.IGNORECASE)
+_SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\snonce\s*=)", re.IGNORECASE)
+_CONDITIONAL_HEADERS = (b"if-none-match", b"if-modified-since", b"if-match", b"if-unmodified-since")
 # Vite/webpack content-hashed file: `index-3f9a8c21.js`, `chunk.AbC123xy.css`.
 _HASHED_FILE = re.compile(r"[-.]([A-Za-z0-9_-]{8,})\.[A-Za-z0-9]+$")
 _PRIVATE_IMMUTABLE = "private, max-age=31536000, immutable"
@@ -94,10 +96,16 @@ async def get_response(self, path: str, scope: Scope) -> Response:
         return response
 
     async def _index_response(self, scope: Scope) -> Response:
-        response = await super().get_response(self._index, scope)
         nonce = (scope.get("state") or {}).get(_NONCE_STATE_KEY)
+        if nonce:
+            # A 304 would revive a cached shell carrying an older nonce (or none).
+            scope = {
+                **scope,
+                "headers": [(k, v) for k, v in scope["headers"] if k not in _CONDITIONAL_HEADERS],
+            }
+        response = await super().get_response(self._index, scope)
         if nonce and isinstance(response, FileResponse) and response.status_code == _OK:
-            response = _with_script_nonce(response, nonce)
+            response = await anyio.to_thread.run_sync(_with_script_nonce, response, nonce)
         # The shell references hashed bundles, so it must revalidate on each visit.
         response.headers[_CACHE_CONTROL] = _NO_CACHE if self._public else _PRIVATE_NO_CACHE
         return response
diff --git a/framework/hosting/simple_module_hosting/middleware.py b/framework/hosting/simple_module_hosting/middleware.py
index 7f913e062..8976dff88 100644
--- a/framework/hosting/simple_module_hosting/middleware.py
+++ b/framework/hosting/simple_module_hosting/middleware.py
@@ -66,6 +66,7 @@
 # browser implementations introduced reflected-XSS vectors of their own.
 # Production CSP authorizes scripts with a per-request nonce.
 _XXSS_DISABLED = "0"
+_HTTP_NOT_MODIFIED = 304
 _REFERRER_STRICT_ORIGIN = "strict-origin-when-cross-origin"
 
 __all__ = [
@@ -92,7 +93,9 @@ class SecurityHeadersMiddleware:
     DEFAULT_CSP = (
         "default-src 'self'; "
         # The request nonce is inserted after static/dynamic sources are merged.
-        "script-src 'self' 'strict-dynamic'; "
+        # 'wasm-unsafe-eval' lets WebAssembly compile (see worker-src below)
+        # without re-allowing JavaScript eval.
+        "script-src 'self' 'strict-dynamic' 'wasm-unsafe-eval'; "
         "script-src-elem 'self' 'strict-dynamic'; "
         "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
         "img-src 'self' data: blob:; "
@@ -169,7 +172,9 @@ async def send_with_headers(message: Message) -> None:
                 headers[_HEADER_X_FRAME_OPTIONS] = _XFO_SAMEORIGIN
                 headers[_HEADER_X_XSS_PROTECTION] = _XXSS_DISABLED
                 headers[_HEADER_REFERRER_POLICY] = _REFERRER_STRICT_ORIGIN
-                if self.csp:
+                # A 304 refreshes the cached response's headers: a new nonce there
+                # would no longer match the cached body, so keep the cached CSP.
+                if self.csp and message.get("status") != _HTTP_NOT_MODIFIED:
                     # Separate policies intersect: sandbox responses cannot replace
                     # the app's default-src, frame-ancestors or other protections.
                     own = (headers.get(_HEADER_CSP) or "").lower()
diff --git a/framework/hosting/tests/test_hosting_csp_nonce.py b/framework/hosting/tests/test_hosting_csp_nonce.py
index 60f751ab1..560e89085 100644
--- a/framework/hosting/tests/test_hosting_csp_nonce.py
+++ b/framework/hosting/tests/test_hosting_csp_nonce.py
@@ -90,6 +90,7 @@ async def page(request):
         for directive in ("script-src", "script-src-elem"):
             assert f"{directive} 'self' 'nonce-{nonce}' 'strict-dynamic'" in csp
         assert "'unsafe-eval'" not in csp
+        assert "'wasm-unsafe-eval'" in csp.split("script-src-elem")[0]  # WASM keeps compiling
         assert "'unsafe-inline'" not in csp.split("style-src")[0]
     else:
         assert "'unsafe-eval'" in csp and "'unsafe-inline'" in csp
@@ -118,3 +119,20 @@ async def page(request):
         "default-src 'self'",
     ):
         assert directive in app_policy
+
+
+async def test_not_modified_keeps_the_cached_policy():
+    """A 304 must not carry a fresh nonce the cached body does not have."""
+    from starlette.responses import Response
+
+    async def page(request):
+        return Response(status_code=304, headers={"etag": '"v1"'})
+
+    app = SecurityHeadersMiddleware(Starlette(routes=[Route("/", page)]))
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        response = await client.get("/")
+    assert response.status_code == 304
+    assert _CSP not in response.headers
+    assert response.headers["x-content-type-options"] == "nosniff"
diff --git a/framework/hosting/tests/test_hosting_spa_mount_nonce.py b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
index 6bed8261f..cef359a7c 100644
--- a/framework/hosting/tests/test_hosting_spa_mount_nonce.py
+++ b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
@@ -42,3 +42,16 @@ async def test_without_a_nonce_the_shell_is_served_unchanged(tmp_path) -> None:
     response = await spa.get_response("", _scope(None))
 
     assert "etag" in response.headers  # still the plain FileResponse
+
+
+async def test_conditional_request_gets_a_fresh_shell_not_a_304(tmp_path) -> None:
+    (tmp_path / "index.html").write_text(_SHELL, encoding="utf-8")
+    spa = SpaStaticFiles(directory=tmp_path, index="index.html")
+    etag = (await spa.get_response("", _scope(None))).headers["etag"]
+    scope = _scope("abc123")
+    scope["headers"] = [(b"if-none-match", etag.encode())]
+
+    response = await spa.get_response("", scope)
+
+    assert response.status_code == 200
+    assert 'nonce="abc123"' in response.body.decode()

From ef438903c7dda1e2d65e9db5ef1002fa54fe40d5 Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Tue, 3 Nov 2026 21:20:26 +0100
Subject: [PATCH 4/5] fix: address code review findings (round 1, pass 2)

- SPA shells: nonce on modulepreload / as=script preloads; drop accept-ranges
- docs: wasm-unsafe-eval, 304 rule, no shared caching of nonce documents,
  shells never answer 304; CHANGELOG notes that script-src origins are
  ignored under 'strict-dynamic'

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 CHANGELOG.md                                            | 4 +++-
 docs/framework/middleware.md                            | 7 ++++++-
 docs/framework/spa-mounts.md                            | 5 +++--
 framework/hosting/simple_module_hosting/_spa_mount.py   | 9 ++++++++-
 framework/hosting/tests/test_hosting_spa_mount_nonce.py | 6 +++++-
 5 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ba3f6a11..b9b3caa04 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,9 @@ All notable changes to this project are documented in this file. The format is b
   (inline or external); inline event handlers (`onclick=`), `eval`/`new
   Function` and scripts injected without a nonce-bearing parent no longer run;
   a module that set its own `content_security_policy` should keep the nonce
-  token. Development keeps the permissive Vite policy. A 304 carries no CSP
+  token. Origins added with `register_csp_sources("script-src", ...)` are ignored by
+  CSP3 browsers under `'strict-dynamic'`: load such scripts from a nonced entry or
+  give the `<script src>` tag the nonce. Development keeps the permissive Vite policy. A 304 carries no CSP
   header, so a cached document keeps the policy its nonce matches.
 - **Behaviour change (#785):** a response CSP containing `sandbox` (file_storage
   downloads) is sent beside the app policy, so browsers enforce both: such
diff --git a/docs/framework/middleware.md b/docs/framework/middleware.md
index 6faf4f00c..81838cdb7 100644
--- a/docs/framework/middleware.md
+++ b/docs/framework/middleware.md
@@ -159,7 +159,12 @@ Sets conservative defaults: `X-Content-Type-Options: nosniff`, `Referrer-Policy:
 
 Outside development, `script-src` and `script-src-elem` use
 `'self' 'nonce-<request nonce>' 'strict-dynamic'`, without `'unsafe-inline'` or
-`'unsafe-eval'`. Each HTTP request gets `request.state.csp_nonce`. The host's
+`'unsafe-eval'`; `script-src` additionally allows `'wasm-unsafe-eval'` so
+WebAssembly can compile without re-enabling JavaScript `eval`. A `304 Not
+Modified` carries no CSP header, so the cached document keeps the policy whose
+nonce matches its body; for the same reason a nonce-bearing document must not
+be stored by a shared cache (`Cache-Control: public`), which would replay one
+nonce to every visitor. Each HTTP request gets `request.state.csp_nonce`. The host's
 pre-paint script and Inertia's module entry carry that nonce; custom templates
 must put `nonce="{{ request.state.csp_nonce }}"` on every executable script,
 including external entries. JSON page data and JSON-LD are inert and need no
diff --git a/docs/framework/spa-mounts.md b/docs/framework/spa-mounts.md
index 32f49ba61..1496f7220 100644
--- a/docs/framework/spa-mounts.md
+++ b/docs/framework/spa-mounts.md
@@ -43,8 +43,9 @@ CSP applies as for any response; whitelist external origins the SPA needs with
 `'nonce-<request nonce>' 'strict-dynamic'`, under which CSP3 browsers ignore
 origin allowlists, so the mount stamps the request nonce onto every `<script>`
 tag of the shell's `index.html` as it serves it (an existing `nonce=` is kept)
-and drops the shell's `ETag`/`Last-Modified`, because a revalidated copy would
-carry a stale nonce. Scripts the shell's entry loads are trusted through
+and drops the shell's `ETag`/`Last-Modified` and ignores the request's
+conditional headers (`If-None-Match` and friends), so a revalidation always gets
+a fresh `200` instead of a `304` that would revive a stale nonce. Scripts the shell's entry loads are trusted through
 `'strict-dynamic'`. Development retains the permissive Vite policy.
 
 ## Boot check
diff --git a/framework/hosting/simple_module_hosting/_spa_mount.py b/framework/hosting/simple_module_hosting/_spa_mount.py
index af77f1e07..13e3de504 100644
--- a/framework/hosting/simple_module_hosting/_spa_mount.py
+++ b/framework/hosting/simple_module_hosting/_spa_mount.py
@@ -41,6 +41,12 @@
 # Set by SecurityHeadersMiddleware for every HTTP request.
 _NONCE_STATE_KEY = "csp_nonce"
 _SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\snonce\s*=)", re.IGNORECASE)
+# Vite shells preload their chunks; a script preload without the nonce is refused.
+_SCRIPT_PRELOAD_WITHOUT_NONCE = re.compile(
+    r"<link\b(?=[^>]*\b(?:rel\s*=\s*[\"']?modulepreload|as\s*=\s*[\"']?script))"
+    r"(?![^>]*\snonce\s*=)",
+    re.IGNORECASE,
+)
 _CONDITIONAL_HEADERS = (b"if-none-match", b"if-modified-since", b"if-match", b"if-unmodified-since")
 # Vite/webpack content-hashed file: `index-3f9a8c21.js`, `chunk.AbC123xy.css`.
 _HASHED_FILE = re.compile(r"[-.]([A-Za-z0-9_-]{8,})\.[A-Za-z0-9]+$")
@@ -121,10 +127,11 @@ def _with_script_nonce(response: FileResponse, nonce: str) -> Response:
     """
     html = Path(response.path).read_text(encoding="utf-8")
     html = _SCRIPT_WITHOUT_NONCE.sub(f'<script nonce="{nonce}"', html)
+    html = _SCRIPT_PRELOAD_WITHOUT_NONCE.sub(f'<link nonce="{nonce}"', html)
     headers = {
         k: v
         for k, v in response.headers.items()
-        if k.lower() not in ("content-length", "etag", "last-modified")
+        if k.lower() not in ("content-length", "etag", "last-modified", "accept-ranges")
     }
     return Response(html, status_code=_OK, headers=headers, media_type="text/html")
 
diff --git a/framework/hosting/tests/test_hosting_spa_mount_nonce.py b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
index cef359a7c..f306f6e66 100644
--- a/framework/hosting/tests/test_hosting_spa_mount_nonce.py
+++ b/framework/hosting/tests/test_hosting_spa_mount_nonce.py
@@ -11,7 +11,9 @@
 
 _SHELL = (
     '<html><head><script type="module" src="/legacy/assets/index-3f9a8c21b.js"></script>'
-    '<script nonce="kept">window.a = 1</script></head><body></body></html>'
+    '<script nonce="kept">window.a = 1</script>'
+    '<link rel="modulepreload" href="/legacy/assets/chunk-a1b2c3d4.js">'
+    '<link rel="stylesheet" href="/legacy/assets/index.css"></head><body></body></html>'
 )
 
 
@@ -29,6 +31,8 @@ async def test_index_scripts_carry_the_request_nonce(tmp_path) -> None:
     body = response.body.decode()
     assert '<script nonce="abc123" type="module" src="/legacy/assets/' in body
     assert '<script nonce="kept">' in body  # an author's own nonce is left alone
+    assert '<link nonce="abc123" rel="modulepreload"' in body
+    assert '<link rel="stylesheet"' in body  # only script preloads need it
     # The nonce changes per response, so no validator may revive an old shell.
     assert "etag" not in response.headers
     assert "last-modified" not in response.headers

From ae1c8df6421f1dc8d1e2ade5f8ffd949b45a6b4c Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Tue, 3 Nov 2026 21:21:30 +0100
Subject: [PATCH 5/5] fix: preload regex matches real attributes only; docs
 mention preload links

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 docs/framework/spa-mounts.md                          | 2 +-
 framework/hosting/simple_module_hosting/_spa_mount.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/framework/spa-mounts.md b/docs/framework/spa-mounts.md
index 1496f7220..997e51053 100644
--- a/docs/framework/spa-mounts.md
+++ b/docs/framework/spa-mounts.md
@@ -42,7 +42,7 @@ CSP applies as for any response; whitelist external origins the SPA needs with
 `register_csp_sources`. In production the script policy is
 `'nonce-<request nonce>' 'strict-dynamic'`, under which CSP3 browsers ignore
 origin allowlists, so the mount stamps the request nonce onto every `<script>`
-tag of the shell's `index.html` as it serves it (an existing `nonce=` is kept)
+tag (and `modulepreload` / `as="script"` preload link) of the shell's `index.html` as it serves it (an existing `nonce=` is kept)
 and drops the shell's `ETag`/`Last-Modified` and ignores the request's
 conditional headers (`If-None-Match` and friends), so a revalidation always gets
 a fresh `200` instead of a `304` that would revive a stale nonce. Scripts the shell's entry loads are trusted through
diff --git a/framework/hosting/simple_module_hosting/_spa_mount.py b/framework/hosting/simple_module_hosting/_spa_mount.py
index 13e3de504..44384c788 100644
--- a/framework/hosting/simple_module_hosting/_spa_mount.py
+++ b/framework/hosting/simple_module_hosting/_spa_mount.py
@@ -43,7 +43,7 @@
 _SCRIPT_WITHOUT_NONCE = re.compile(r"<script\b(?![^>]*\snonce\s*=)", re.IGNORECASE)
 # Vite shells preload their chunks; a script preload without the nonce is refused.
 _SCRIPT_PRELOAD_WITHOUT_NONCE = re.compile(
-    r"<link\b(?=[^>]*\b(?:rel\s*=\s*[\"']?modulepreload|as\s*=\s*[\"']?script))"
+    r"<link\b(?=[^>]*\s(?:rel\s*=\s*[\"']?modulepreload|as\s*=\s*[\"']?script))"
     r"(?![^>]*\snonce\s*=)",
     re.IGNORECASE,
 )