fix(security): use CSPRNG for CSP nonce generation

[fengmk2]

Problem

The CSP nonce (ctx.nonce) was generated with nanoid/non-secure, which derives every character from Math.random(). Math.random() is not cryptographically secure and its internal state can be recovered from observed outputs, making the nonce predictable. A predictable nonce weakens nonce-based CSP as a defense against XSS.

Fix

Import nanoid from its crypto-backed entry point instead of nanoid/non-secure, so the nonce stays unpredictable. No API or output-shape change (still a 16-char URL-safe string).

Test

Added a regression test that pins Math.random to a constant and asserts the nonce is still unpredictable across requests. It fails on the old non-secure import (nonce collapses to a constant value) and passes with the crypto-backed RNG.

plugins/security suite: 199 passed, 4 skipped.

[gemini-code-assist]

Code Review

This pull request replaces the non-secure nanoid/non-secure import with the cryptographically secure nanoid in the security plugin's context. It also adds a test case to ensure that the generated CSP nonce is unpredictable even when Math.random is mocked. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a06f2cff-630e-4a44-ab26-0679dec40c68

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-csp-nonce-csprng

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying egg-v3 with    Cloudflare Pages

Latest commit:	10d759f
Status:	✅  Deploy successful!
Preview URL:	https://e5e149dd.egg-v3.pages.dev
Branch Preview URL:	https://fix-security-csp-nonce-csprn.egg-v3.pages.dev

View logs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.80%. Comparing base (1836bce) to head (10d759f).

Additional details and impacted files

@@            Coverage Diff             @@
##             next    #5966      +/-   ##
==========================================
+ Coverage   85.32%   85.80%   +0.48%     
==========================================
  Files         670      658      -12     
  Lines       19553    19266     -287     
  Branches     3864     3795      -69     
==========================================
- Hits        16683    16531     -152     
+ Misses       2479     2365     -114     
+ Partials      391      370      -21     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.