Nonce
A nonce is a per-request random value that permits one specific inline script under a strict CSP.
Why it matters
It allows a strict script-src, but it requires reading request headers, which forces dynamic rendering on every route.
How it is measured
Check whether the CSP script-src contains a nonce value that changes between two requests.
Checks that involve nonce
Related terms
Questions
What is nonce?
A nonce is a per-request random value that permits one specific inline script under a strict CSP.
Why does nonce matter?
It allows a strict script-src, but it requires reading request headers, which forces dynamic rendering on every route.
How is nonce measured?
Check whether the CSP script-src contains a nonce value that changes between two requests.