Should we change how we generate our CSP nonce?

[G-Rath]

Currently we generate our nonce with a completely random value each time:

config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }

However, Rails 8 uses the request.session.id:

config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }

I believe technically this could mean more reuse in the generator, as the session id assumingly is reused across all requests for the particular session, but I'm not sure if that actually matters (nor if it means that the actual nonce will be the same for all requests), and it might be nicer if we're aligned with the rails default for future upgrades

[joshmcarthur]

Unless we have an actual compelling reason to not do what Rails does, I'd prefer we stick with what Rails would normally do.

[lukeify]

The pros and cons of both solutions are discussed in the Rails guide. I also lean towards what Rails does by default.

[G-Rath]

We've decided to switch to the Rails default since we don't think there's an immediate or significant security issue and it means a slightly smaller diff for future Rails upgrades