在日常开发中，Passkeys 无密码认证推广实践 is being used more and more frequently. This article systematically explains its usage, principles, and optimization strategies.

Quick Start

The key lies in understanding the core logic:

function setCSP(req, res, next) {
  const nonce = crypto.randomBytes(16).toString('base64')
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}'`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'"
  ].join('; '))
  next()
}

Performance optimization should be tailored to specific scenarios; not all cases require over-optimization.

Internal Principles

We can improve it in the following ways:

function setCSP(req, res, next) {
  const nonce = crypto.randomBytes(16).toString('base64')
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}'`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'"
  ].join('; '))
  next()
}

This approach has been running stably in production for over six months and has been practically validated.

Business Practice

Let's start with the basic implementation:

function setCSP(req, res, next) {
  const nonce = crypto.randomBytes(16).toString('base64')
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}'`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'"
  ].join('; '))
  next()
}

This code demonstrates the basic usage. In real projects, you also need to consider error handling and edge cases.

Performance Comparison

Building on this foundation, we can further optimize:

function setCSP(req, res, next) {
  const nonce = crypto.randomBytes(16).toString('base64')
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}'`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'"
  ].join('; '))
  next()
}

This pattern is very practical in large projects and can significantly reduce maintenance costs.

Summary

• In team collaboration, conventions and documentation are more important than the technology itself
• Stay updated with the community; technical solutions need continuous iteration
• Don't adopt new technology just for the sake of it
• Code examples are for reference only and need to be adjusted according to your business scenario