5eea161d8b
There's been some confusion on the correct way to add a `nonce`, so took the opportunity here to: - Add a new docs page for Content Security Policy - Explained how to generate a `nonce` with Middleware - Showed how to consume the `nonce` in a route with `headers` - Updated the `with-strict-csp` example - Update the `nonce` error message page - Backlinked to the new page in a few places in the docs
24 lines
800 B
Text
24 lines
800 B
Text
---
|
|
title: nonce contained invalid characters
|
|
---
|
|
|
|
## Why This Error Occurred
|
|
|
|
A request to your Next.js application contained a `Content-Security-Policy`
|
|
header with a `script-src` directive and `nonce` that contains
|
|
invalid characters (any one of `<>&` characters). For example:
|
|
|
|
- `'nonce-<script />'`: not allowed
|
|
- `'nonce-/>script<>'`: not allowed
|
|
- `'nonce-PHNjcmlwdCAvPg=='`: allowed
|
|
- `'nonce-Lz5zY3JpcHQ8Pg=='`: allowed
|
|
|
|
## Possible Ways to Fix It
|
|
|
|
We recommend using a randomly generated UUID for your nonce.
|
|
|
|
Learn more about how to use nonces with Next.js in our [Content Security Policy](/docs/app/building-your-application/configuring/content-security-policy) docs.
|
|
|
|
## Useful Links
|
|
|
|
- [Content Security Policy](/docs/app/building-your-application/configuring/content-security-policy)
|