---
title: "Nonce"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3-request-attribute-nonce@main"
source: "ApiOverview/RequestLifeCycle/RequestAttributes/Nonce.rst"
rendered: "2026-09-26T10:15:30+00:00"
---

# Nonce {#typo3-request-attribute-nonce}

The `nonce` request attribute is related to
[Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@main).

> [!NOTE]
> **See also**
>
> [https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce)

It is always available in backend context and only in frontend context, if the
according [feature](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-features-security-frontend-enforcecontentsecuritypolicy@main)
is enabled.

One can retrieve the nonce like this:

**EXT:my_extension/Classes/MyClass.php (excerpt)**

```php
// use TYPO3\CMS\Core\Security\ContentSecurityPolicy\ConsumableNonce

/** @var ConsumableNonce|null $nonce */
$nonceAttribute = $this->request->getAttribute('nonce');
if ($nonceAttribute instanceof ConsumableNonce) {
    $nonce->consumeInline(Directive::ScriptSrcElem); // inline script
    $nonce->consumeStatic(Directive::StyleSrcElem);  // static style
}
```