Home / Knowledge hub / Nonce
Knowledge hub
Nonce
A value issued for a single use, so it cannot be replayed later.
What it means
A nonce is a number used once. NIST describes it as a time-varying value with, at most, a negligible chance of repeating: a fresh random value, a timestamp, a sequence number, or a mixture of those.
The single-use property is what separates a genuine request from a copy of one. It rarely matters whether an attacker can read the value. What matters is whether they can get it accepted twice.
Why it matters
Without one, capturing a valid request is enough to repeat it. A payment submitted again, a password change replayed, a form posted from a page the user never opened. Nothing about the request looks wrong except that you have seen it before.
It also tells your own content from somebody else's. A content security policy can allow a script carrying today's nonce and refuse the rest. An injected script then fails, even though it sits in exactly the right place on the page.
How it shows up
You will meet nonces in content security policy headers, in payment flows, in sign-in and redirect handling, and anywhere a duplicate submission would cost real money. Each one needs the server to remember that the value has been spent.
The mistakes repeat themselves. The value is predictable, so somebody guesses it. It is generated once and reused for every user, which makes it a fixed password rather than a nonce. The server never checks it at all. Or nobody retires it after use, which turns an impatient double-click into a double charge. Check what the server does, not what the page contains.
Questions people ask
Nonce, answered
Does a nonce have to be secret?
Usually not. A content security policy nonce sits in the page source where anyone can read it, and it still works. The browser refuses any script that does not carry the matching value.
What matters is that an attacker cannot predict the next one and cannot reuse the last one.
Does it have to be random, or will a counter do?
NIST allows a counter or a timestamp as well as a random value. The hard requirement is that the value does not repeat.
Unpredictability is the separate question. Where an attacker could guess the next value and get ahead of a legitimate request, use something random and long.
Is a CSRF token the same as a nonce?
Closely related, and not identical. OWASP says a cross-site request forgery token may last one session or one request. It recommends the per-session form for most applications, because per-request tokens break the back button.
So a CSRF token is often not strictly single use. A payment idempotency check or a policy nonce is.
Why use a CSP nonce instead of allowing inline scripts?
Allowing all inline script means an injected script runs too, which removes most of the benefit of having a policy. A nonce lets you keep the scripts you wrote and refuse everything else.
It only holds if the value changes on every response. A nonce baked into a cached template is decoration.
What happens if the same nonce is accepted twice?
You get the thing the nonce existed to prevent. A duplicate charge, a repeated redemption, an invitation used by two people, or a replayed request that looks entirely legitimate in the log.
These are quiet failures. Nobody raises an error, and the first sign is usually a reconciliation that does not balance.
Related
Terms that sit next to this one
CSRF
An attacker's page makes a logged-in user's browser act on your site.
Content Security Policy
A header telling the browser which scripts a page may load.
Session fixation
An attacker sets your session id before login, then waits for it to work.
Token
A string that stands in for an identity or a permission.
Race condition
Two near-simultaneous actions producing a result neither should allow.
What happens on the second try?
Replayed requests, reused tokens and single-use links that turned out not to be single use all sit in scope for us, and each finding arrives with the exact request. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.