Home / Knowledge hub / CSP nonce
Knowledge hub
CSP nonce
A one-time value that marks which inline scripts a content security policy allows.
What it means
A CSP nonce is a random value your server puts in two places: the Content-Security-Policy header (as script-src 'nonce-...') and the nonce attribute of each script tag you wrote. The browser runs only the inline scripts whose attribute matches the header.
That lets you keep your own inline scripts and refuse any other. A script injected through a bug has no way to know the value for this response, so the browser blocks it. The W3C specification says the value should be at least 128 bits and come from a cryptographically secure random generator.
Why it matters
It turns a cross-site scripting bug from a full compromise into a blocked script and a log line. Without a nonce, a policy that has to allow inline scripts must use 'unsafe-inline', which allows an attacker's inline script too and removes most of the protection.
It is also cheap to get wrong in a way that looks fine. A policy with a nonce in the header reads well in an audit, yet gives no protection if the value never changes. Customers and assessors who ask for a content security policy are usually asking for this property.
How it shows up
You meet CSP nonces in server-rendered pages and in frameworks that add them to script tags for you. The server makes a new value for each response, adds it to the header, and passes it to the template. Pages that are cached by a CDN or a full-page cache are the usual trouble.
The repeating mistakes are a nonce baked into a template, one stored value shared by all visitors, a short or guessable value, and a nonce also placed on a script that echoes user input. Fetch the same page twice and compare. If the value matches, it is a fixed string, not a nonce.
Questions people ask
CSP nonce, answered
Is a CSP nonce the same as a hash source?
No. A hash source allows one exact script body by its digest, so it suits static inline scripts. A nonce allows whichever scripts carry the current value, so it suits pages where the script text changes. Both can sit in the same policy.
Does a CSP nonce have to be secret?
It is visible in the page source, so it is not secret from the visitor. What it needs is to be unpredictable before the response is sent and different on the next one. An attacker who cannot guess it cannot make an injected script match.
Can I use a nonce on a statically cached page?
Not safely. A cached page serves the same nonce to everyone until it expires, which makes it a fixed value. Either generate the page per request, or use hashes for the inline scripts on pages that must be cached.
What does strict-dynamic do with a nonce?
With 'strict-dynamic', a script that the nonce trusted may load further scripts, and those inherit trust. It saves you from listing every host, but it also means a vulnerable trusted script can pull in an attacker's one.
How do we test that our nonces work?
Load a page twice and confirm the values differ. Then inject a script tag without a nonce through a known input and confirm the browser blocks it. Also check that no script outside your control carries a nonce.
Sources
Where this comes from
Related
Terms that sit next to this one
Content Security Policy
A header telling the browser which scripts a page may load.
Nonce
A value issued for a single use, so it cannot be replayed later.
XSS
An attacker's script running in your pages, in your customers' sessions.
CSP report-only mode
Trying a content security policy by logging breaches without blocking anything.
Stored XSS
Malicious script saved by your app and then served to other people who view it.
Does the policy really block a planted script?
We test whether a script injected through your inputs actually runs under your policy, and each finding carries the request, the response and a screenshot. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.