Frontend & browser·Browser security
each inline script tag carries a random token that matches the header, and anything without one is refused.
CSP nonce
Also callednonce, strict-dynamic
A per-response random value placed on the header and on each permitted inline script, so only scripts the server actually emitted may run. It is what makes a strict policy workable for server-rendered pages that need inline script. It must be freshly generated per response and genuinely unpredictable — a nonce on a cached page is the same as having no policy.