title: Content-Security-Policy HTTP header not working properly for script-src
body: <p>I am following <a href="https://csp.withgoogle.com/docs/strict-csp.html" rel="nofollow noreferrer">Google's strict CSP policy</a> for my CSP header, and I am properly adding the nonce, however I keep getting this error in the browser for my scripts:</p>
  
  <blockquote>
    <p>Refused to load the script
    '<a href="http://localhost:8080/client/dist/inline.6e0c61259742e86be1dd.bundle.js" rel="nofollow noreferrer">http://localhost:8080/client/dist/inline.6e0c61259742e86be1dd.bundle.js</a>'
    because it violates the following Content Security Policy directive:
    "script-src nonce-XVlBzgbaiCMRAjWwhTHctcuAxhxKQFDaFpLSjFbcXoEFfRsWxP
    'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:".
    'strict-dynamic' is present, so host-based whitelisting is disabled.</p>
  </blockquote>
  
  <p>As you can see, the nonce matches the nonce in the script:</p>
  
  <pre><code>&lt;script type="text/javascript" src="/client/dist/inline.6e0c61259742e86be1dd.bundle.js" nonce="XVlBzgbaiCMRAjWwhTHctcuAxhxKQFDaFpLSjFbcXoEFfRsWxP"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>This is the CSP header I'm using for <code>script-src</code>. The "%s" represents the random generated nonce which will be interpolated before the header is set on the response:</p>
  
  <pre><code>script-src nonce-%s 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
  </code></pre>
  
  <p>What am I doing wrong here?</p>