Government Drupal Developers Network · Community platform

Add a CSP nonce to inline scripts

Generate a per-request nonce so you can drop 'unsafe-inline' from your Content-Security-Policy.

Government Digital Service · 26 Sept 2026

function mytheme_page_attachments_alter(array &$attachments) {
  $nonce = \Drupal::service('csp.nonce')->getValue();
  $attachments['#attached']['drupalSettings']['cspNonce'] = $nonce;
}

#security
#csp
#php

Join GDDN to upvote and share your own resources.