Skip to Content (Press Enter)
UserImage.jpg
Balaji Ravikumar
83Views
3Comments
How to use Nonce attribute in inline Javascript
Question
JavaScript
Beginner
OutSystems 11
Security
Traditional Web
Application Type
Traditional Web

Hi All,

      I want to use the "Nonce" attribute in my inline script to avoid CSP misconfiguration, so i need to generate it on my script, is any one can help me on this with some examples.


Thanks in Advance

0
0
21 Jul 2022
Copy Link
2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

Hi Balaji,

Why you think you need to use this, as it is suggested to not use it if not needed. Not using inline scripts is one of the biggest security wins CSP provides. 

For using nonce on inline script, did you already loot at the following documentation:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script

Regards,

Daniel

0
0
21 Jul 2022
Copy Link
UserImage.jpg
Balaji Ravikumar

Hi @Daniël Kuhlmann 

          We found inline script in our application so after pen test they saying its CSP misconfiguration and they suggested to use "Nonce" in inline scripts. 

Thanks

Balaji

0
0
21 Jul 2022
Copy Link
2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

Replying to Balaji Ravikumar's comment on 21 Jul 2022 06:41:24

I think it is not the best suggestion. The best solution is to avoid inline script.

1
0
21 Jul 2022
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.