spaze/nonce-generator

Content Security Policy nonce generator

Maintainers

👁 spaze

Package info

github.com/spaze/nonce-generator

pkg:composer/spaze/nonce-generator

Statistics

Installs: 4 874

Dependents: 1

Suggesters: 1

Stars: 7

Open Issues: 0

v4.0.3 2025-11-23 00:37 UTC

Requires

Suggests

  • spaze/csp-config: Build and send Content Security Policy header, possibly including nonce, if enabled
  • spaze/sri-macros: For script tags with automatically added Content Security Policy nonces, and Subresource Integrity hashes, too

Provides

None

Conflicts

None

Replaces

None

MIT d82b6aa4a455c7e78b87233181b6d54f94d41a3c

README

👁 PHP Tests

This generates random nonces for Content Security Policy nonce attributes. These nonces work with CSP3 strict-dynamic which aims to make Content Security Policy simpler to deploy for existing applications. This package is intended to be used with Nette Framework, spaze/csp-config and spaze/sri-macros.

Usage

This is a plug and play generator.

If installed, \Spaze\ContentSecurityPolicy\Config::addDirective() from spaze/csp-config will automatically add nonce-... attribute to configured directives, and Latte macros {script ...} and {stylesheet ...} from spaze/sri-macros will add nonce="..." attribute to script and style attributes respectively. Also n:nonce shortcut will use the same generated value.

Installation

With Composer:

composer require spaze/nonce-generator

Add the extension to your configuration:

extensions:
	nonceGenerator: Spaze\NonceGenerator\Bridges\Nette\GeneratorExtension

Requirements

  • PHP 8.2 or newer
  • Latte 3.0 or newer
  • Nette Application 3.1 or newer
  • Nette DI 3.0 or newer

API

createNonce(): Nonce

Generates and returns a Nonce object. Use Nonce::getValue() to get the generated nonce.