User Guide Cancel

getCSPNonce

 

Description

The GetCSPNonce function fetches the value of the nonce that will be applied to the Content Security Policy header for a particular request. If the CSP header contains a nonce, any JavaScript executing in the context of that request will need to specify the same nonce. Failure to do so will make the browser consider this block of code as a threat and block it's loading and execution.

ColdFusion supports the following:

  • getCSPNonce(): Returns the nonce value.
  • getCSPNonce(boolean returnAsString): Returns the nonce value as a string like 'nonce=<nonce_value>' that can be directly used in a cfheader tag or in a <script> tag.

History

  • ColdFusion (2025 release): Added the function.

Example

<cfoutput>
<script type="text/javascript" nonce="#GetCSPNonce()#">
alert("Message")
</script>
</cfoutput>
<cfoutput> <script type="text/javascript" nonce="#GetCSPNonce()#"> alert("Message") </script> </cfoutput>
<cfoutput>
<script type="text/javascript" nonce="#GetCSPNonce()#">
	alert("Message")
</script>
</cfoutput>

Using getCSPNonce(boolean returnAsString)

<cfoutput>
<script type="text/javascript" #GetCSPNonce(true)#>
alert("Message");
</script>
</cfoutput>
<cfoutput> <script type="text/javascript" #GetCSPNonce(true)#> alert("Message"); </script> </cfoutput>
<cfoutput>
<script type="text/javascript" #GetCSPNonce(true)#>
	alert("Message");
</script>
</cfoutput>

Get help faster and easier

New user?