Skip to content
Trilha

Error catalog

E_CSP_NONCE

An inline script or style has no nonce

The page writes a <script> or <style> inline without the nonce the Content-Security-Policy announces. The browser refuses to run it, so the page passes a test that only reads the HTML and breaks on the screen.

Fix

Write it with trilha.NonceAttr(c) — h.Script(trilha.NonceAttr(c), h.Raw(js)) — or move the code to a file under public/ and load it with src. `trilha audit` points at the page; PageSnapshot.HasCSPNonce checks the served HTML.

h.Script(trilha.NonceAttr(c), h.Raw(js))