Review this generated dashboard response before production deployment.
Render an authenticated dashboard with a per-response CSP nonce, minimal page-specific headers, safely serialized profile data, bounded history, and consistent protection on every response path.
JavaScript
const nonce = Math.random().toString(36);
const sharedPolicy = "default-src *; script-src * 'unsafe-inline'";
function generatedHeaders(request) {
return {
'Content-Security-Policy': sharedPolicy,
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
'X-Content-Type-Options': 'nosniff',
'Permissions-Policy': `camera=(${request.query.cameraOrigin})`,
};
}
async function renderDashboard(request, response, db) {
if (request.path === '/health') {
return response.status(200).send('ok');
}
const history = await db.events.findAll({ userId: request.user.id });
response.set(generatedHeaders(request));
response.send(`<script nonce="${nonce}">window.data=${JSON.stringify(history)}</script>`);
}
generated code is illustrative, not from any one model