Renders a nonce="<value>" HTML attribute when the csp() context processor is configured, and an empty string otherwise. Use it on <script> or <link> elements to allow them under a nonce-based Content Security Policy.
New in Django 6.1.
Arguments
- No arguments – renders just the
nonceattribute, for placing inside a tag you wrote yourself. - A
Mediaobject – renders that object's assets, with the nonce applied to each<script>and<link>element.
Basic Usage
Add the nonce attribute to your own script and stylesheet tags:
Template
<script src="/path/to/script.js" {% csp_nonce_attr %}></script>
<link rel="stylesheet" href="/path/to/style.css" {% csp_nonce_attr %}>
Result
<script src="/path/to/script.js" nonce="r@nd0mv4lu3"></script> <link rel="stylesheet" href="/path/to/style.css" nonce="r@nd0mv4lu3">
Rendering Form Media
Pass a Media object and the tag renders the whole asset block for you, nonce included:
Template
{% csp_nonce_attr form.media %}
Result
<link href="/static/css/widget.css" media="all" rel="stylesheet" nonce="r@nd0mv4lu3"> <script src="/static/js/widget.js" nonce="r@nd0mv4lu3"></script>
Requirements
The nonce value comes from the django.template.context_processors.csp context processor. In both forms above, if that context processor is not configured, the assets are rendered without a nonce attribute.
Settings
TEMPLATES = [
{
"BACKEND": "django.template.backends.django.DjangoTemplates",
"OPTIONS": {
"context_processors": [
# ...
"django.template.context_processors.csp",
],
},
},
]
Commentary
A nonce-based Content Security Policy is one of the better defenses against cross-site scripting, and until now wiring one up in templates meant reaching for a third-party package like
django-cspor hand-rolling a context variable. Having it in core is a real win.The
{% csp_nonce_attr form.media %}form is the one to remember. Form media has always been awkward under CSP because you do not control the markup Django generates for it — you just render{{ form.media }}and hope. This tag hands you that same block with nonces attached.Watch out for the silent failure. If you forget the
csp()context processor, this tag does not raise an error — it renders an empty string, and your assets go out with no nonce at all. If your CSP is not enforcing yet, everything will look like it is working. Check the rendered HTML for an actualnonceattribute before you trust it.Note this tag handles the nonce only. You still need to send the
Content-Security-Policyheader itself, and a nonce in your markup does nothing until that header names it.