Release Incident Playbook

CSP blocks required script: symptoms, cause, and the test that catches it

A Content Security Policy change blocks a script the page needs.

CSP blocks required script is documented by 2 accepted public reports from 2 organisations, 2 of them published in the last 5 years.

  • Likelihood: low (2 public reports in 5 years)
  • Impact: medium (2 of 2 reports: availability)

2 public reports · verified 2026-10-21

Symptoms

User-visible

  • The single-page app showed a blank page or an endless spinner on most reloads after an upgrade that enabled a nonce-based content security policy (a response header that lists which scripts and resources a page may load).[1]
  • Some reloads worked and others failed on the same server and the same browser.[1]
  • The blank page reproduced in two different desktop browsers.[1]
  • Clicking the OAuth login button on the /login/ page had no effect after a container image upgrade.[2]
  • A second user reported the same dead login button.[2]

Monitoring-visible

  • The process kept running, and the health endpoint, login API and other APIs returned 200 while users saw a blank page.[1]
  • No client or server error was visible, and an 11-point health-check script passed.[1]
  • The Content-Security-Policy response header carried a nonce, while the rendered HTML contained no nonce attribute on the script tag.[1]
  • The browser console showed a Content Security Policy error refusing to run an inline event handler under a script-src directive with strict-dynamic and a nonce.[2]
  • The first signal of the login failure was a user report in the public issue tracker.[2]

Root causes

  1. stage: code The CSP nonce was generated with standard base64, and whenever the value contained a + or / character, the server's HTML template engine silently removed the nonce attribute from the script tag, so the policy blocked the inline script.[1]
  2. stage: code The previous release did not enable a CSP, so the upgrade switched on nonce handling in that deployment for the first time.[1]
  3. stage: third-party A new image added nonce attributes and a strict script-src policy, while the login page of an upstream web framework dependency still used an inline event handler that the policy did not allow.[2]
  4. stage: release-process The operators declared the upgrade successful after checking APIs only and learned about the blank pages from their users.[1]

Public examples

  1. [1]FileBrowser Quantum, 2026-09-23. After a deployment was upgraded from FileBrowser Quantum v2.0.0-beta to v2.0.8-beta, which enables a nonce-based Content Security Policy, the nonce attribute was often dropped from the inline script tag, so the browser blocked the script and the single-page app showed a blank page. primary [Bug] [Critical] Intermittent blank page in v2.0.8-beta: CSP nonce generated with base64.StdEncoding is silently stripped by html/template
  2. [2]Apache Superset, 2023-07-05. After moving to the latest Apache Superset docker image, which added nonce attributes and a strict script-src Content Security Policy, the browser refused an inline event handler on the login page and the OAuth login button did nothing. primary OAuth login broken with Content Security Policy

Test classes that catch it

Test classStageLimitationBasis
End-to-end testspre-deployA single end-to-end page load can pass, because the nonce attribute was dropped only on loads where the random nonce contained a + or / character.by design analysis
Security testspre-deployA check that reads only the Content-Security-Policy response header passes, because that header carried a valid nonce while the rendered HTML had lost it.by design analysis
Synthetic monitoringpost-deployAn API-level synthetic check passes, because the health endpoint and login API kept returning 200 while the browser refused to run the page script.by design analysis

Risk

  • Likelihood: low (2 public reports in 5 years)
  • Impact: medium (2 of 2 reports: availability)
Counts behind the grades
Accepted public reports2
Published in the last 5 years2
Impact stated: availability2

How the grades are computed

Pre-release checklist

  • PR-01
  • PR-02
  • PR-03
  • PR-04
  • PR-05
  • PR-06
  • PR-07

First 30 minutes

  • FM-01
  • FM-02
  • FM-03
  • FM-04
  • FM-05
  • FM-06
  • FM-07

Download the checklist

What catches this: catalogue entries

Listed because their own documentation or site names end-to-end tests, security tests, synthetic monitoring on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Providers whose site names these test classes

Only on this page

In report [1], every server-side signal stayed green while users saw a blank page. The process kept running, the health endpoint and APIs returned 200, and an 11-point health-check script passed. The operators declared the upgrade successful after checking APIs only and heard about the blank pages from users.

The fault was also intermittent. The nonce was dropped only when its random base64 value contained a + or / character, so some reloads worked on the same server and browser [1]. The reporter proposed a test that the rendered HTML contains the nonce [1]. A check of the response header alone passes, because the header always carried the nonce.

Questions

What causes CSP blocks required script?

In report [1], a base64 nonce containing + or / was silently stripped from the script tag by the template engine, so the policy blocked the script. In report [2], a new strict script-src policy blocked an inline event handler on a framework login page.

What are the symptoms of CSP blocks required script?

Users saw a blank page or an endless spinner on most reloads [1]. In report [2], the OAuth login button did nothing and the browser console showed a Content Security Policy error.

Why did tests not catch CSP blocks required script?

In report [1], the health endpoint and APIs returned 200 and an 11-point health-check script passed. The fault lives in the rendered HTML in the browser, which none of those checks loaded.

Which test class catches CSP blocks required script, and what does it miss?

End-to-end tests, security tests and synthetic monitoring carry the by-design label, because neither report names a test class. A single end-to-end page load can miss report [1], where only some reloads failed.

What should be checked before a release to prevent CSP blocks required script?

Item PR-03 compares the nonce attribute on every script tag with the nonce in the response header. Item PR-04 confirms the nonce generator never emits + or / characters.

Should a team roll back or fix forward when CSP blocks required script happens?

In report [2], rolling back to version 2.1.0 restored login. The interim workaround there was a CSP config that allowed unsafe-inline scripts, and a later framework release added nonce support.

Release Incident Playbook (2026). CSP blocks required script: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/csp-blocks-required-script/. Accessed 2026-10-21.