HTML Code

<!DOCTYPE html>



<html lang=en>



<head>



  <meta charset=UTF-8>



  <meta name=viewport content="width=device-width,initial-scale=1">



  <title>nonce — script.nonce property</title>



  <style>body{font-family:system-ui,sans-serif;margin:0;padding:1.5rem;background:#f8fafc;color:#334155;line-height:1.7}h1{margin:0 0 .75rem;font-size:1.25rem;color:#0f172a}.result{margin-top:1rem;padding:.75rem 1rem;background:#eff6ff;border:1px solid #bfdbfe;border-radius:8px;font-size:.8125rem;max-width:480px}code{background:#e2e8f0;padding:.1rem .35rem;border-radius:4px}.note{margin-top:.75rem;font-size:.8125rem;color:#64748b;max-width:480px}</style>



</head>



<body>



  <h1>Reading script.nonce</h1>



  <p>Server renders a unique nonce per request (simulated here as a fixed demo value):</p>







  <script id=trusted nonce=server-generated-x9k2m>var el=document.getElementById("trusted"),output=document.createElement("div");output.className="result",output.innerHTML="<strong>script.nonce =</strong> <code>"+el.nonce+"</code><br>Use the same value in your CSP header: <code>script-src 'nonce-"+el.nonce+"'</code>",document.body.appendChild(output)</script>







  <p class=note><strong>Note:</strong> Nonces must be generated on the server for each response. Setting <code>nonce</code> from client JavaScript after load does not satisfy CSP for inline scripts.</p>



</body>



</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

HTML nonce Attribute — script.nonce Property