chore: Revert CSP nonce (revert #5568)

[steverydz]

Done

Reverts the changes introduced in #5568. Removes the CSP nonce mechanism and restores the previous CSP configuration, including 'unsafe-inline' in script-src-elem for Google Tag Manager compatibility.

• Removed import copy and import secrets
• Removed generate_nonce() before-request handler
• Removed CSP_NONCE from template context
• Restored 'unsafe-inline' in script-src-elem
• Reverted add_script_hashes_and_nonce_to_csp back to add_script_hashes_to_csp
• Removed nonce="{{ CSP_NONCE }}" from all affected templates

How to QA

1. Start the app: dotrun
2. Open any page and inspect the Content-Security-Policy response header
3. Verify script-src-elem contains 'unsafe-inline' and no nonce-* value
4. Verify that GTM and other inline scripts load correctly without CSP errors in the browser console

Testing

• This PR has tests
• No testing required (explain why): This is a revert of a previous change with no new logic introduced.

Security

• Security considerations for review (list them):
  • Examples:
  • Access control: users can only access their own data
  • Input: user input is validated and sanitised
  • Sensitive data: secret or private data is not exposed in any way
  • ...
• This PR has no security considerations (explain why): Restores the pre-feat: Add nonce to strengthen CSP #5568 CSP configuration which was the accepted baseline before the nonce mechanism was introduced.

Issue / Card

Screenshots

UX Approval

• This PR does not require UX approval
• This PR does require UX approval (add context):

[webteam-app]

Demo

Jenkins

demos.haus

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Removes the CSP nonce mechanism and updates templates/CSP handling to allow inline scripts without per-request nonces.

Changes:

• Removed CSP nonce generation and template exposure (CSP_NONCE).
• Updated CSP construction logic for scripts and adjusted allowed sources.
• Removed nonce="{{ CSP_NONCE }}" from a large set of templates’ <script> tags.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
webapp/handlers.py	Removes nonce generation/context and changes CSP generation logic and directives.
templates/tutorials/tutorial.html	Removes CSP nonce attributes from inline scripts.
templates/store/store.html	Removes CSP nonce from JSON-LD script tag.
templates/store/snap-distro-install.html	Removes CSP nonce from JSON-LD script tag.
templates/store/snap-details/_templates.html	Removes CSP nonce from template script tags.
templates/store/snap-details/_details.html	Removes CSP nonce from inline scripts.
templates/store/snap-details/_channel_map.html	Removes CSP nonce from template script tags.
templates/store/snap-details.html	Removes CSP nonce from JSON-LD and inline scripts.
templates/store/publisher.html	Removes CSP nonce from inline bootstrap script.
templates/store/publisher-details.html	Removes CSP nonce from template and inline scripts.
templates/shared/contact-form-modal.html	Removes CSP nonce from template script tag.
templates/publisher/publicise/store_buttons.html	Removes CSP nonce from inline script.
templates/publisher/developer_programme_agreement.html	Removes CSP nonce from inline script.
templates/publisher/collaboration.html	Removes CSP nonce from inline bootstrap script.
templates/partials/_video.html	Removes CSP nonce from inline script.
templates/index.html	Removes CSP nonce from external and inline scripts.
templates/docs/document.html	Removes CSP nonce from inline script.
templates/blog/index.html	Removes CSP nonce from inline script.
templates/blog/article.html	Removes CSP nonce from JSON-LD, template, and inline scripts.
templates/admin/admin.html	Removes CSP nonce from inline bootstrap script.
templates/about/publish.html	Removes CSP nonce from inline script.
templates/_layout-embedded.html	Removes CSP nonce from JSON-LD script tag.
templates/_base-layout.html	Removes CSP nonce usage, including GTM nonce propagation and multiple script tags.

[abbiesims]

When I click "Accept all" to accept cookies, I am getting the below errors in my console - it may be an unrelated issue though

[ilayda-cp]

should we add this?

[steverydz]

@ilayda-cp It was only added in the nonce PR but I'll re-add it to be safe

[ilayda-cp]

@abbiesims i think its unrelated because we were getting this issue during work together as well.