Comparison
Content Security PolicyvsCSP nonce
Content Security Policy
an injected script was blocked because the browser refused to run anything from an origin not on the list.
A response header declaring which sources of script, style, image and connection the page may use, enforced by the browser. It is a second line of defence: it does not prevent injection, it prevents the injected thing from doing anything useful. Rolling one out realistically means starting in report-only mode, because inline scripts, inline event handlers and `eval` in dependencies all break under a strict policy.
Full entry →CSP nonce
each inline script tag carries a random token that matches the header, and anything without one is refused.
A per-response random value placed on the header and on each permitted inline script, so only scripts the server actually emitted may run. It is what makes a strict policy workable for server-rendered pages that need inline script. It must be freshly generated per response and genuinely unpredictable — a nonce on a cached page is the same as having no policy.
Full entry →