HTML <script> nonce Attribute

The nonce allow the execution of inline scripts in a Content Security Policy (CSP). Here's how one might use it with the CSP script-src directive:

script-src "nonce-4985ed";

Note: We are using the phrase: 4985ed to denote a random value. You should use a cryptographically secure random token generator to generate a nonce value. The random nonce value should only be used for a single HTTP request.

You can allow an inline <script> tag to execute by adding our random nonce value in the nonce attribute of the script tag:

Example

<script nonce="4985ed">
  myFunction();
</script>

Meaning

A cryptographic nonce (number used once) to allow scripts in a script-src Content-Security-Policy.

The server must generate a unique nonce value each time it transmits a policy.

It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.

Standard Syntax

<script nonce="number">

Attribute Values