CSP nonce sources
Authorises selected inline scripts with unpredictable, response-specific nonce values.
Support in current browsers
Checked against the current browser versions recorded in MDN browser data 8.0.7.
| Browser | Minimum | Outcome | Reason |
|---|---|---|---|
| Chrome | 150 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Edge | 150 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Firefox | 152 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Safari | 26.5 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Chrome for Android | 150 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Firefox for Android | 152 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Safari on iOS | 26.5 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Android WebView | 150 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
| Samsung Internet | 29.0 | Not enough browser data | BCD 8.0.7 does not publish a standalone compatibility statement for CSP nonce source expressions. |
What this feature can and cannot do
Helps protect against
- Injected inline script execution
Does not guarantee
- Nonce disclosure or reuse
- Unsafe trusted scripts
- DOM injection that reaches an allowed sink
What you need before using it
- Per-response nonce generation
- A CSP script source policy
Fallback to keep in place
Use a carefully scoped CSP and avoid inline script where a nonce deployment cannot be validated.