CSP Nonce Workflow

1) Nonce generator (demo)

Use this to sanity-check formatting. In production, generate a fresh nonce per HTTP response and inject it into both the CSP header and matching nonce attributes.

Nonce bytes 16 bytes (OK) 24 bytes (recommended) 32 bytes (strong) Nonce (base64) Paste-ready CSP header value HTML example

Minimum good baseline included: default-src 'self', object-src 'none', base-uri 'self', frame-ancestors 'none'.

2) Server-side patterns (copy/paste)

Pick your stack and replace ${NONCE} with your per-response nonce.

Node/Express (per request) nginx (template variable approach) Apache (conceptual; use app to generate nonce)

Rules of thumb

• Nonce must be unpredictable and unique per response. Don’t reuse across pages/users.
• Only add the nonce to the specific inline tags you intend to allow.
• Start with Content-Security-Policy-Report-Only in staging, then enforce.