How deeply does Building Web APIs with ASP.NET Core cover nonce?

Defines the nonce, applies matching values in the policy and script element, and warns against production inline scripts.

Nonce

As explained in Building Web APIs with ASP.NET Core

A script nonce is a cryptographically unpredictable token that authorizes a specific inline script under a content security policy.

A script nonce is a random, cryptographically unpredictable identifier. A Content-Security-Policy header permits an inline script only when its script element carries the same nonce value. section 12.4.4

Apply a nonce when a narrowly permitted inline script is required:

Add the nonce to the script-src directive in the Content-Security-Policy response header. section 12.4.4
Set the identical nonce value in the inline script element returned by the endpoint. section 12.4.4
Redeploy the application and verify that the browser executes the permitted script. section 12.4.4

Permitting one test script

The /cod/test Minimal API endpoint returns an inline script with a nonce, while the CSP header allows that same nonce. The browser alert then runs after redeployment. Avoid this pattern in production unless on-demand inline code is genuinely necessary, because it weakens the policy’s purpose. section 12.4.4

Refused to execute inline script because it violates the following Content Security Policy directive: "default-src ' self' ". Either the ‘unsafe-inline’ keyword, a hash (‘sha256-j3kW1ylRRXx1+pINyR/6EW435UHoxKSlU6fhd5xVSSk=‘), or a nonce (' nonce-...' ) is required to enable inline execution. Note also that ' script-src'  was not explicitly set, so ' default-src'  is used as a fallback.

Use the browser console violation to diagnose a blocked inline script and identify when a hash or nonce is required. section 12.4.4

How Building Web APIs with ASP.NET Core covers it

Cover of Building Web APIs with ASP.NET Core

liveBook manning.com

Read Building Web APIs with ASP.NET Core on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Real-World CryptographyA nonce is a value intended to distinguish cryptographic operations and, in signature generation, is typically required to be unique for each signature under a key.
liveBook manning.com

Hacking CryptographyA cryptographic nonce is a value intended to be used once to prevent identical cryptographic inputs from producing repeated protected outputs.
liveBook manning.com

Software Security for DevelopersA nonce is a value intended to be used only once within a specified cryptographic or authentication context.

Compare how 4 books explain nonce →

Related concepts

ECDSAused by · ECDSA is a public-key digital signature algorithm that uses elliptic-curve arithmetic to generate and verify signatures.
replay attackaddresses · A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
initialization vectorincludes · An initialization vector is a typically nonsecret value supplied to a cryptographic operation to initialize or vary its processing across uses.
Content-Security-Policyconfigures · Content Security Policy is a web security standard that lets a site specify browser-enforced rules restricting the sources and forms of content a document may load or execute.
authenticated encryption with associated dataused by · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.
openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.

This explainer was generated by Manning's knowledge graph from the text of Building Web APIs with ASP.NET Core. The section links point to the parts of the book it draws on.