Cybersecurity glossary
What is a CSP Nonce?
Learn what a CSP nonce is, how nonce-based script-src blocks inline injection, how to generate and apply nonces safely, and which caching mistakes break nonce CSP.
Definition
A CSP nonce is a cryptographically strong, per-response random value included in a Content-Security-Policy script-src (or style-src) directive and mirrored on trusted script or style tags so browsers allow only those specifically marked inline resources.
Why CSP nonces matter
Classic CSP allowlists of hosts struggle with CDNs, JSONP gadgets, and sprawling third parties. A CSP nonce flips the model: instead of listing every host, you mark the specific inline scripts you trust on this response. Injected <script> tags without the nonce fail under a strict script-src.
Nonces are central to modern “strict CSP” deployments that aim to make XSS much harder to turn into script execution.
How nonce-based CSP works
Generate a random nonce per response
Create a strong unpredictable value while rendering HTML.
Put the nonce in CSP
Send Content-Security-Policy with script-src 'nonce-....' (often with strict-dynamic).
Stamp trusted script tags
Add nonce="..." to intentional inline scripts included in that response.
Browser allows matching scripts
Only scripts carrying the correct nonce satisfy the policy (plus other allowed sources).
Injected scripts without nonce fail
Attacker HTML that inserts a bare script tag is blocked.
Nonce vs hash vs host allowlists
| Approach | Strength | Trade-off |
|---|---|---|
| Nonce | Allows flexible inline scripts that change per deploy | Requires per-response generation and careful caching |
| Hash | Pins exact inline content without server-side stamping | Breaks when inline content changes; awkward for dynamic inline |
| Host allowlist | Simple mental model | Weak against JSONP/CDN gadgets and broad wildcards |
Operational pitfalls
Public caching of HTML
Cached pages with embedded nonces desynchronize from CSP headers or leak reusable nonces.
Nonce in static files
Build-time nonces in immutable JS bundles defeat per-response freshness.
Logging nonces insecurely
Treat nonces as sensitive to request forgery of allowlisted execution within their lifetime.
unsafe-inline leftovers
Keeping 'unsafe-inline' alongside nonces can nullify XSS protection in older policy interactions—know your CSP level behavior.
Implementation checklist
- Generate a fresh cryptographically strong nonce for every HTML response.
- Mirror the exact nonce in CSP and on each trusted inline script/style tag.
- Disable shared public caching for personalized nonce-bearing HTML.
- Prefer strict-dynamic with nonces for modern script loading patterns.
- Remove unsafe-inline from script-src once nonces cover legitimate inline needs.
- Cover all template entry points—error pages and emails-to-HTML views included.
- Monitor CSP reports for blocked legitimate scripts during rollout.
- Do not place long-lived nonces in static CDN objects.
The practical takeaway
A CSP nonce is a per-response secret that allowlists specific inline scripts (and optionally styles) under Content Security Policy. It is one of the strongest practical CSP techniques against injected script tags.
Generate nonces carefully, never cache them as shared public HTML, and pair them with encoding/sanitization so CSP remains a backstop—not the only XSS control.
Related security terms
Content Security Policy (CSP)
Parent policy mechanism that consumes nonces in script-src and style-src.
CSP Hash
Alternative allowlisting of exact inline content via cryptographic hashes.
CSP strict-dynamic
Directive value often paired with nonces to trust script-loaded scripts.
Cross-Site Scripting (XSS)
Injection class nonce-based CSP is designed to contain.
Frequently asked questions
What is a CSP nonce in simple terms?
It is a one-time random password for scripts on that page response. Only script tags stamped with the same nonce as the CSP header are allowed to run.
How long should a nonce be?
Use a cryptographically strong random value with sufficient entropy—commonly at least 128 bits—encoded for use in the header and HTML attribute.
Can I reuse a nonce across users or pages?
No. Reusing nonces lets attackers predict or replay allowlisted values. Generate a fresh nonce for every HTML response.
Why do CDNs break nonce CSP?
If a shared cache serves one user’s HTML (with nonce A) alongside another response’s policy (nonce B), trusted scripts fail or policies weaken. Nonce pages must not be cached as public shared content.
Do nonces replace output encoding?
No. Nonces are defense in depth. Preventing injection remains primary.
Can attackers read the nonce from the page?
If they already have script execution, the game is largely lost. The goal is to stop injected markup from becoming executable without the nonce in the first place.
Should styles use nonces too?
If you disallow unsafe-inline for style-src, style nonces or hashes are needed for intentional inline CSS.
References
Explore authoritative guidance and frameworks related to csp nonce.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.