csp_nonce

Available since Exponential 6.0.15 (in development, not in a release yet).

Summary

The template operator csp_nonce(): the nonce of the Content Security Policy of this request, for an inline script a template cannot move into a file (expContentSecurityPolicy::templateNonce()).

Description

The template operator csp_nonce(): the nonce of the Content Security Policy of this request, for an inline script a template cannot move into a file (expContentSecurityPolicy::templateNonce()).

<code> <script nonce="{csp_nonce()}">...</script> </code>

An empty string when the policy of the siteaccess carries no nonce. The nonce is new for every request: never print it inside a {cache-block} or a view-cached template, whose cached copy would carry the nonce of another request.

Source

Implemented by expContentSecurityPolicyOperator (kernel/common/expcontentsecuritypolicyoperator.php).

See also

Generated example: csp_nonce

Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this operator.