CSP headers with a script-src nonce directive for Kirby

config.php

<?php

/*
---------------------------------------
HTTP Security headers
---------------------------------------
*/

// Generating CSP nonce & defining CSP header
$csp_nonce = base64_encode(random_bytes(20));
$csp_header = "Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-" . $csp_nonce . "';";

// Making it accessible as `csp-nonce`
c::set('csp-nonce', $csp_nonce);

// Setting security headers
header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
header($csp_header);
header('Strict-Transport-Security: max-age=31536000; includeSubdomains');

template-or-snippet.php

<script type="text/javascript" nonce="<?= c::get('csp-nonce') ?>">
  console.log('Hello World!')
</script>