A small piece of HTML can change what a visitor sees or how the browser understands a page. In this lesson, you will explore nonce attribute: trusted scripts and styles using a short example that you can inspect and change.
The Idea in Plain English
A CSP nonce is a cryptographically unpredictable value generated fresh for each HTTP response. The header and the allowed inline script or style must use the same nonce.
HTML supplies the structure; JavaScript supplies the behavior described here. If you remove the script, check what remains usable for visitors.
A Working Example
Read the sample once before copying it. Notice the element names and attribute values, then compare them with the explanation below.
<!-- Illustration only: the server must generate a fresh value for every response. -->
<script nonce="SERVER_GENERATED_RANDOM_VALUE">
document.querySelector("h1").textContent = "Ready";
</script>What Each Part Does
- The script element can load code or hold data; the type attribute tells the browser how to treat its contents.
- nonce associates a trusted inline block with a matching CSP nonce.
A browser following the matching CSP can run a permitted inline block and reject other inline scripts.
Keep the example small while learning. Once it behaves as expected, try it inside a larger page and make sure the URLs, files and surrounding HTML are correct.
Try It Yourself
Try this next: illustrate a server-generated nonce on a script. Then inspect the page and explain what changed.
Common Beginner Mistakes
- Reusing a fixed nonce across requests or exposing a placeholder as a production security mechanism.
- Changing several parts of the example at once, making it difficult to see which part caused a different result.
- Choosing a tag only because its default appearance looks right, without checking whether it describes the content correctly.
Key Takeaways
- A CSP nonce is a cryptographically unpredictable value generated fresh for each HTTP response. The header and the allowed inline script or style must use the same nonce.
- A browser following the matching CSP can run a permitted inline block and reject other inline scripts.
- Test the markup in a browser, and check accessibility and real-world behavior where relevant.