# posthtml-nonce
**Repository Path**: mirrors_posthtml/posthtml-nonce
## Basic Information
- **Project Name**: posthtml-nonce
- **Description**: A posthtml plugin create whitelist for specific inline scripts using a cryptographic nonce
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No
## Statistics
- **Stars**: 0
- **Forks**: 0
- **Created**: 2020-09-25
- **Last Updated**: 2025-10-12
## Categories & Tags
**Categories**: Uncategorized
**Tags**: None
## README
# posthtml-nonce
> A posthtml plugin create whitelist for specific inline scripts,styles,images,media using a cryptographic nonce
[](https://travis-ci.org/posthtml/posthtml-nonce)[]()[](https://www.npmjs.com/package/posthtml-nonce)[](https://david-dm.org/posthtml/posthtml-nonce)[](https://github.com/sindresorhus/xo)[](https://coveralls.io/r/posthtml/posthtml-nonce)
## Why?
The HTTP [`Content-Security-Policy`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).
> Used in conjunction with the `middleware`
## Install
```bash
npm i -S posthtml posthtml-nonce
```
> **Note:** This project is compatible with node v6+
## Usage
```js
import {readFileSync, writeFileSync} from 'fs';
import posthtml from 'posthtml';
import posthtmlNonce from 'posthtml-nonce';
const html = readFileSync('input.html', 'utf8');
posthtml()
.use(posthtmlNonce({tags: ['links'], nonce: '4f90d13a42'}))
.process(html)
.then(result => {
writeFileSync('output.html', result.html);
});
```
## Example
input.html
```html
```
output.html
```html
```
> *will be added nonce attribute with nanoid*
## Options
### `tags`
Type: `Array`(***required***)
Default: `[]`
Description: *You can also expand the list by adding the tags you need...*
### `nanoid`
Type: `String`(***required***)
Default: ``
Description: *nanoid*
```
output.html
```html