CSP Nonce
A CSP nonce is a random value generated per request, attached to script/style tags and the CSP header, allowing only inline scripts carrying the matching nonce.
Purpose
To safely allow trusted inline scripts without loosening CSP to unsafe-inline; the recommended modern CSP approach.
Mechanism
The server generates a random nonce per request; the CSP header includes script-src 'nonce-abc123', and <script nonce=abc123> in the page is allowed to execute. Attackers cannot predict the nonce, so injected scripts are blocked.
Use cases
- Safe inline script allowance
- CSP hardening
- XSS defense