I have an angular web app implementing nonce for CSP. To be more precise, my nginx server, proxying incoming request generates a nonce that he will substitute in both my CSP header and my code before replying to each client. The line responsible of it in my nginx conf is : sub_filter 'random-nonce-placeholder' $csp_nonce; This works very well. I know want to make my angular app a PWA. I successfully published my PWA, but the service worker is keeping failing caching my index.html file because of hash mismatch. Which is normal, because my index.html file is changing at every load. Here's my error : [11s119u] Error(Hash mismatch (cacheBustedFetchFromNetwork): http://localhost:8000/index.html: expected 160ce202e458c63b9aaaa1c5906bbd45fdd73389, got f774417697894c39f598d78f1ea452f6d134e034 (after cache busting), SwCriticalError@http://localhost:8000/ngsw-worker.js:164:7 Does that mean that CSP nonce is completely incompatible with PWA ? Isn't there a way to make both of them work on the same app ? It's quite an issue if lowering the app security is necessary to make PWAs ... I tried to remove the index.html from the cached file but of course it doesn't work. And I'm not sure to understand how/if he can modify the hash of ngsw-worker when serving a client. Continue reading...
