CSP nonce enforcement bypassed on Turbo Drive navigation (security-relevant)

1

Hi all,

I’ve found that Turbo Drive appears to bypass CSP script-src nonce enforcement when it swaps the document. Steps to reproduce and video are in the linked issues below.

  • A Rails app with the default nonce-based content_security_policy correctly blocks a bare inline <script> (no nonce) on a normal/full page load.
  • After clicking a link and having the same page load via Turbo Drive, that same inline script executes, even though the CSP header/nonce hasn’t changed.

This matters beyond a cosmetic bug:
CSP nonces are often relied on as a defense-in-depth layer against XSS. If Turbo’s script re-execution path doesn’t apply the same nonce check the browser would apply on a real navigation, that protection silently stops working for any page loaded via Turbo. This matters if an app has an unrelated stored-XSS bug elsewhere.

Allready filed with repro steps + a screen recording:

Both have been open for a while without any responses. Maybe here is the better place to get some visibility and optionons on this topic.

2

I second this.

I find it strange that Rails has a dedicated way to setup CSP and then Turbo as one of its default components completely bypasses the protection it offers without even informing developers about it.

As it stands, using Turbo with CSP nonces reduces your app’s security compared to not using Turbo.