---
title: "Nonce"
manual: "TYPO3 Explained"
version: "13.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3-request-attribute-nonce@13.4"
source: "ApiOverview/RequestLifeCycle/RequestAttributes/Nonce.rst"
rendered: "2026-09-18T05:52:58+00:00"
---

# Nonce {#nonce}

The `nonce` request attribute is related to [Content Security Policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@13.4).

> [!NOTE]
> **See also**
>
> [https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce)

It is always available in backend context and only in frontend context, if the
according [feature](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-features-security-frontend-enforcecontentsecuritypolicy@13.4)
is enabled.

One can retrieve the nonce like this:

**EXT:my_extension/Classes/MyClass.php (excerpt)**

```php
// use TYPO3\CMS\Core\Security\ContentSecurityPolicy\ConsumableNonce

/** @var ConsumableNonce|null $nonce */
$nonceAttribute = $this->request->getAttribute('nonce');
if ($nonceAttribute instanceof ConsumableNonce) {
    $nonce->consumeInline(Directive::ScriptSrcElem); // inline script
    $nonce->consumeStatic(Directive::StyleSrcElem);  // static style
}
```

<!-- TODO: no Markdown rendering for "versionchanged" -->

Since TYPO3 v13.4.20 the ConsumableNonce
class does not inherit from ConsumableString
anymore.