As you probably saw in the other post, the docs have some info on using a Content Security Policy. But the toolbar does not currently support strict-dynamic CSP.

Pauline already shared the previous post with the engineering team, and I'll link this post as well.

I moved this topic to the #feedback category and extended the expiration date so others can add join the conversation

Any hope to see this land some time this year?

I've just hit this issue today too. We use the Toolbar in all environments - local/dev, preview, and production - so this means we have to leave 'unsafe-inline' styles on for now.

If the toolbar could accept a nonce, or use the one from middleware, that would be great.

This issue prevents my company from using the Vercel toolbar, which is a shame. It would be so easy to pass a nonce to the toolbar!

If you add the toolbar using the @vercel/toolbar package, you can pass the nonce as a prop like <VercelToolbar nonce={nonce} />

This is experimental. It's not fully documented and not many teams have used it yet. If you try it, please let us know whether it works well or needs iteration 🙏

This approach doesn’t make sense at all if you’re generating the nonces in middleware. CSP is delivered as a series of response headers, so generating the values in middleware seems to make the most sense, right?

Passing nonce to the toolbar doesn’t resolve the iOS The operation is insecure error