Use Content-Security-Policy nonce support on Default login and passkey registration pages #19844

The default login page (DefaultLoginPageGeneratingFilter) and the default passkey registration page (DefaultWebAuthnRegistrationPageGeneratingFilter) both bootstrap Spring Security's passkey JavaScript with an inline <script> that has no nonce attribute. The registration page also uses an inline onclick="return false" handler.

Under a strict Content Security Policy that only allows inline scripts by nonce (for example script-src 'self' 'nonce-{nonce}', which gh-10826 / #18499 adds support for), the browser blocks those inline scripts, so passkey sign-in and registration don't work on the default pages. External scripts such as /login/webauthn.js are fine under 'self'.

When a ContentSecurityPolicyNonce is available as a request attribute (ContentSecurityPolicyNonce.class.getName()), these pages could render its value as the nonce attribute on their inline scripts, and the onclick handler could be replaced with script. FormPostRedirectStrategy already does something similar for its own template.

As a workaround, applications can supply their own login and registration pages that use the nonce.