CSP nonce enforcement bypassed on Turbo Drive navigation (security-relevant)

1

Hi all,

I’ve found that Turbo Drive appears to bypass CSP script-src nonce enforcement when it swaps the document. Steps to reproduce and video are in the linked issues below.

  • A Rails app with the default nonce-based content_security_policy correctly blocks a bare inline <script> (no nonce) on a normal/full page load.
  • After clicking a link and having the same page load via Turbo Drive, that same inline script executes, even though the CSP header/nonce hasn’t changed.

This matters beyond a cosmetic bug:
CSP nonces are often relied on as a defense-in-depth layer against XSS. If Turbo’s script re-execution path doesn’t apply the same nonce check the browser would apply on a real navigation, that protection silently stops working for any page loaded via Turbo. This matters if an app has an unrelated stored-XSS bug elsewhere.

Allready filed with repro steps + a screen recording:

Both have been open for a while without any responses. Maybe here is the better place to get some visibility and optionons on this topic.