From c7fb37356e5e0ce2eb2f7f7de9806f39dd29e31c Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Sat, 1 Aug 2026 22:09:22 +0200
Subject: [PATCH] fix: remove nonce from style-src to allow unsafe-inline to
 work

---
 src/lib/csp.test.ts | 3 +--
 src/lib/csp.ts      | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/lib/csp.test.ts b/src/lib/csp.test.ts
index c32e8e15..3e14d0d9 100644
--- a/src/lib/csp.test.ts
+++ b/src/lib/csp.test.ts
@@ -13,8 +13,7 @@ describe("csp", () => {
 		expect(csp).toContain("script-src");
 		expect(csp).toContain("'nonce-testNonce123'");
 		expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/);
-		expect(csp).toContain("style-src 'self' 'nonce-testNonce123'");
-		expect(csp).not.toMatch(/style-src(?!-attr)[^;]*'unsafe-inline'/);
+		expect(csp).toContain("style-src 'self' 'unsafe-inline'");
 		expect(csp).toContain("style-src-attr 'unsafe-inline'");
 		expect(csp).toContain("https://challenges.cloudflare.com");
 		expect(csp).toContain("https://cdn.jsdelivr.net");
diff --git a/src/lib/csp.ts b/src/lib/csp.ts
index cc17facb..0962d2a4 100644
--- a/src/lib/csp.ts
+++ b/src/lib/csp.ts
@@ -19,7 +19,6 @@ export function buildContentSecurityPolicy(nonce: string): string {
 	const styleSrc = [
 		"'self'",
 		"'unsafe-inline'",
-		`'nonce-${nonce}'`,
 		"https://fonts.googleapis.com",
 	].join(" ");