HTML Code

<!DOCTYPE html>

<html lang=en>

<head>

  <meta charset=UTF-8>

  <meta name=viewport content="width=device-width,initial-scale=1">

  <title>nonce — inline script CSP</title>

  <meta http-equiv=Content-Security-Policy content="script-src 'nonce-trusted123'; style-src 'unsafe-inline'">

  <style>body{font-family:system-ui,sans-serif;margin:0;padding:1.5rem;background:#f8fafc;color:#334155;line-height:1.7}h1{margin:0 0 .75rem;font-size:1.25rem;color:#0f172a}.box{margin-top:.75rem;padding:.75rem 1rem;border-radius:8px;font-size:.8125rem;max-width:480px}.allowed{background:#f0fdf4;border:1px solid #bbf7d0}.blocked{background:#fef2f2;border:1px solid #fecaca;color:#991b1b}code{background:#e2e8f0;padding:.1rem .35rem;border-radius:4px}pre{margin:.75rem 0 0;padding:.65rem .85rem;background:#1e293b;color:#e2e8f0;border-radius:6px;font-size:.7rem;overflow-x:auto;max-width:480px}</style>

</head>

<body>

  <h1>nonce + Content-Security-Policy</h1>

  <p>CSP allows only scripts whose <code>nonce</code> matches the policy:</p>

  <pre>Content-Security-Policy: script-src 'nonce-trusted123'</pre>

  <div class="box allowed" id=allowed>Waiting for trusted script…</div>

  <div class="box blocked" id=blocked>This inline script has no nonce — CSP blocks it (check console).</div>



  <script nonce=trusted123>

    document.getElementById("allowed").textContent =

      "This script ran because nonce="trusted123" matches the CSP header.";

  </script>



  <script>document.getElementById("blocked").textContent="If you see this, CSP did not block this script (should not happen with strict CSP)."</script>

</body>

</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

HTML nonce Attribute — Inline Script with CSP