---
title: "Security.nonce ViewHelper <f:security.nonce>"
manual: "Fluid ViewHelper Reference"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3viewhelper:typo3-fluid-security-nonce@main"
source: "Global/Security/Nonce.rst"
modified: "2026-09-15T08:11:10+00:00"
---

# Security.nonce ViewHelper `<f:security.nonce>`

> [!NOTE]
> **Changed in version 14.1, 13.4.23**
>
> CSP nonce sources set via the `{f:security.nonce()}` ViewHelper are no
> longer incorrectly considered negligible. The newly introduced `directive`
> and `scope` arguments allow TYPO3 to correctly assign that nonce to the
> appropriate CSP directive, whereas previously the nonce could be silently
> discarded due to missing context.

The `{f:security.nonce()}` ViewHelper generates a CSP
([Content Security Policy](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/ContentSecurityPolicy/Index.html#content-security-policy))
nonce and registers it for inclusion in the CSP header.

> [!TIP]
> **Hint**
>
> The `{f:security.nonce()}` view-helper is meant as a compatibility
> fallback. It is suggested to use more specific ViewHelpers like
> [Asset.css ViewHelper \<f:asset.css>](https://docs.typo3.org/permalink/t3viewhelper:typo3-fluid-asset-css@main)
> or [Asset.script ViewHelper \<f:asset.script>](https://docs.typo3.org/permalink/t3viewhelper:typo3-fluid-asset-script@main).

Go to the source code of this ViewHelper: [Security\\NonceViewHelper.php (GitHub)](https://github.com/TYPO3/typo3/blob/main/typo3/sysext/fluid/Classes/ViewHelpers/Security/NonceViewHelper.php).

**Table of contents**

-   [Examples of security.nonce ViewHelper usage](https://docs.typo3.org/permalink/t3viewhelper:examples-of-security-nonce-viewhelper-usage@main)
-   [Arguments of the <f:security.nonce> ViewHelper](https://docs.typo3.org/permalink/t3viewhelper:arguments-of-the-f-security-nonce-viewhelper@main)

## Examples of security.nonce ViewHelper usage

**Basic usage**

```html
<script nonce="{f:security.nonce()}">const inline = 'script';</script>
```

The optional arguments `directive` and `scope` can be used to explicitly
declare how the generated nonce should be applied to the Content Security
Policy. This avoids ambiguity and allows TYPO3 to assign the nonce to the
correct CSP directive.

### Inline script (default scope)

Inline scripts require the nonce to be registered for the
`script-src` CSP directive. The `inline` scope is the default and may be
omitted.

**Inline script with explicit directive**

```html
<script nonce="{f:security.nonce(directive: 'script-src')}">
    const test = true;
</script>
```

### External script (static scope)

When a nonce is applied to an external script, the `static` scope should
be used. This allows TYPO3 to correctly associate the nonce with a static
script element.

**External script with nonce**

```html
<script
    src="{scriptUri}"
    nonce="{f:security.nonce(directive: 'script-src', scope: 'static')}"></script>
```

### Inline styles with nonce attribute

The ViewHelper can also be used for inline styles by specifying the
corresponding style directive.

**Inline style block**

```html
<style nonce="{f:security.nonce(directive: 'style-src')}">
    body {
        background-color: #f5f5f5;
    }
</style>
```

## Arguments of the `<f:security.nonce>` ViewHelper

> [!NOTE]
> **New in version 14.1, 13.4.23**
>
> The arguments `directive` and `scope` were introduced.

Parameter `directive` can be one of `default-src`, `script-src`,
`script-src-elem`, `style-src`, or `style-src-elem` (referring to a CSP directive).

-   **directive**

    -   *Type:* string

    Value of the CSP directive

-   **scope**

    -   *Type:* string
    -   *Default:* 'inline'

    \`inline\` or \`static\`