Some HTML attributes belong to one particular tag. A global attribute can be written on many different HTML elements. nonce is one of them, and it helps with supplies a server-generated csp nonce to allowed inline scripts/styles.
What nonce changes
Supplies a server-generated CSP nonce to allowed inline scripts/styles. You attach it to an opening HTML tag, usually beside other attributes.
Global does not mean the browser handles it identically on every element. Its usefulness still depends on the element, surrounding markup, accessibility requirements, and browser support.
Example in a real page
<script nonce="SERVER_GENERATED_VALUE">
console.log("Page ready");
</script>What to notice
Find nonce in the opening tag. Its position among other attributes does not change its meaning; the name and value (or mere presence, for boolean attributes) are what matter.
A real nonce must be unpredictable, unique per response, and match the CSP response policy.
Using it in your projects
Start with the simplest HTML that works. Add this attribute when your page actually needs supplies a server-generated csp nonce to allowed inline scripts/styles. If changing the attribute does not visibly change the page, inspect how the browser or accessibility tree uses it rather than assuming the code failed.
For example, an attribute may give information to keyboard users, screen readers, a JavaScript component, or a stylesheet without changing the appearance of text.
Mini exercise
Copy the example into a test page. Remove nonce, check the result, then restore it. Describe exactly what changed—and what stayed the same.
Common Beginner Mistakes
- A real nonce must be unpredictable, unique per response, and match the CSP response policy.
- Assuming every global attribute is appropriate on every tag without checking the context.
- Using a browser hint as if it enforces security or saves data automatically.
Key Takeaways
nonce: Supplies a server-generated CSP nonce to allowed inline scripts/styles.- A real nonce must be unpredictable, unique per response, and match the CSP response policy.
- Prefer clear native HTML, and test features that depend on browser support.