---
title: '{% csp_nonce_attr %}'
description: renders the CSP nonce attribute on `<script>` and `<link>` tags.
date: '2026-07-31'
categories:
  - Template Tag
  - Utility
canonical: https://coolify.djangotemplatetagsandfilters.com/tags/csp_nonce_attr/
doc_link: https://docs.djangoproject.com/en/6.1/ref/templates/builtins/#csp_nonce_attr
---

# {% csp_nonce_attr %}

renders the CSP nonce attribute on `<script>` and `<link>` tags.

## Documentation

Renders a `nonce="<value>"` HTML attribute when the `csp()` context processor is configured, and an empty string otherwise. Use it on `<script>` or `<link>` elements to allow them under a nonce-based [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP).

**New in Django 6.1.**

#### Arguments

- **No arguments** – renders just the `nonce` attribute, for placing inside a tag you wrote yourself.
- **A `Media` object** – renders that object's assets, with the nonce applied to each `<script>` and `<link>` element.

#### Basic Usage

Add the nonce attribute to your own script and stylesheet tags:

#### Template

```django
<script src="/path/to/script.js" {% csp_nonce_attr %}></script>
<link rel="stylesheet" href="/path/to/style.css" {% csp_nonce_attr %}>
```

#### Result

```django
<script src="/path/to/script.js" nonce="r@nd0mv4lu3"></script>
<link rel="stylesheet" href="/path/to/style.css" nonce="r@nd0mv4lu3">
```

#### Rendering Form Media

Pass a `Media` object and the tag renders the whole asset block for you, nonce included:

#### Template

```django
{% csp_nonce_attr form.media %}
```

#### Result

```django
<link href="/static/css/widget.css" media="all" rel="stylesheet" nonce="r@nd0mv4lu3">
<script src="/static/js/widget.js" nonce="r@nd0mv4lu3"></script>
```

#### Requirements

The nonce value comes from the `django.template.context_processors.csp` context processor. In both forms above, if that context processor is not configured, the assets are rendered without a nonce attribute.

#### Settings

```django
TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "OPTIONS": {
            "context_processors": [
                # ...
                "django.template.context_processors.csp",
            ],
        },
    },
]
```

## Commentary

A nonce-based Content Security Policy is one of the better defenses against cross-site scripting, and until now wiring one up in templates meant reaching for a third-party package like `django-csp` or hand-rolling a context variable. Having it in core is a real win.

The `{% csp_nonce_attr form.media %}` form is the one to remember. Form media has always been awkward under CSP because you do not control the markup Django generates for it — you just render `{{ form.media }}` and hope. This tag hands you that same block with nonces attached.

**Watch out for the silent failure.** If you forget the `csp()` context processor, this tag does not raise an error — it renders an empty string, and your assets go out with no nonce at all. If your CSP is not enforcing yet, everything will look like it is working. Check the rendered HTML for an actual `nonce` attribute before you trust it.

Note this tag handles the *nonce* only. You still need to send the `Content-Security-Policy` header itself, and a nonce in your markup does nothing until that header names it.