---
title: "Nonce"
manual: "TYPO3 Explained"
version: "12.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3-request-attribute-nonce@12.4"
source: "ApiOverview/RequestLifeCycle/RequestAttributes/Nonce.rst"
rendered: "2026-10-21T15:29:37+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v12 has reached end-of-life as of April 30th 2026 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v12 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Nonce {#typo3-request-attribute-nonce}

<!-- TODO: no Markdown rendering for "versionadded" -->

The `nonce` request attribute is related to [Content Security Policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@12.4).

> [!NOTE]
> **See also**
>
> [https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce)

It is available in backend and frontend context, if the according feature is
enabled:

-   [$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['security.backend.enforceContentSecurityPolicy'\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-features-security-backend-enforcecontentsecuritypolicy@12.4)
-   [$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['security.frontend.enforceContentSecurityPolicy'\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-features-security-frontend-enforcecontentsecuritypolicy@12.4)

One can retrieve the nonce like this:

```php
// use TYPO3\CMS\Core\Domain\ConsumableString

/** @var ConsumableString|null $nonce */
$nonceAttribute = $this->request->getAttribute('nonce');
if ($nonceAttribute instanceof ConsumableString) {
    $nonce = $nonceAttribute->consume();
}
```