script-src strict-dynamic
The loader has a nonce and runs. But the <script> it creates dynamically has no nonce — the browser blocks it. Without 'strict-dynamic', trust doesn't pass from a trusted script to the scripts it injects.
Response header
Content-Security-Policy: script-src 'nonce-ykl+lazVEgauDHuziQk6Uw=='
Loader script in page source
<script nonce="ykl+lazVEgauDHuziQk6Uw==">
var s = document.createElement('script');
s.src = '/lab-assets/scripts/sdk.js';
document.head.appendChild(s);
</script>
Loader script
Injected script (/lab-assets/scripts/sdk.js)
Check the browser console to see the CSP violation error.