Your second point (passing tokens to third-party) is addressed by the new 'strict-dynamic' [1] keyword in CSP3. It allows nonced/hashed scripts to dynamically

Your second point (passing tokens to third-party) is addressed by the new 'strict-dynamic' [1] keyword in CSP3. It allows nonced/hashed scripts to dynamically create child elements without explicitly passing the nonce. E.g. you nonce/hash your google-maps widget loading script and 'strict-dynamic' will allow the widget to dynamically load additional child scripts (e.g. js module loading) via document.createElement/appendChild. Therefore you only need to nonce the scripts you trust in your markup and don't need to refactor libraries to grab an pass on the nonce. Some 'strict-dynamic' deployment examples: https://photos.google.com/ https://photos.google.com/ https://www.google.com/about/careers/jobs https://www.google.com/about/careers/jobs https://www.google.com/maps/timeline https://www.google.com/maps/timeline https://bugs.chromium.org/hosting/ https://bugs.chromium.org/hosting/ [1] https://w3c.github.io/webappsec-csp/#strict-dynamic-usage https://w3c.github.io/webappsec-csp/#strict-dynamic-usage [2] http://www.slideshare.net/LukasWeichselbaum/making-csp-great-again-appseceu-64689735 http://www.slideshare.net/LukasWeichselbaum/making-csp-great...