Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : This is functional