Generating nonces for the ASAP add-on - Zoho Desk Knowledgebase

Generating nonces for the ASAP Help Widget

Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You need to modify the code to generate and pass a nonce value to the script attribute in the ASAP code snippet.

What is a nonce?

A nonce with respect to content security policy is a word or phrase used only once, and it should be so random that they are unpredictable. For example, a nonce should be a cryptographically strong random value that is at least 128 bits in length. It is also necessary that a new nonce is generated for every page load to prevent attackers from injecting arbitrary scripts bypassing CSP.

Why should you use nonces?

When you use CSP, you will need to add a nonce to every inline script block. The nonce lets the browser know that the server intended on serving this script block only if the nonce attribute in the script tag matches the nonce value in the CSP header. This way, you can use it to detect and mitigate the likes of Cross-Site Scripting (XSS) and data injection attacks.

How to generate nonce values?

From your web server, generate a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. Note that you must generate nonces differently each time the page loads (but, nonce only once). Here are some examples:

Nodejs Script:

const var = require( 'crypto' );
var.randomBytes(16).toString( 'base64' );
//  '6JDFIvPbrWANKpSJ8vlv6b=='

Java:

String nonce = new String(DigestUtils.md5Hex(String.valueOf(new SecureRandom().nextLong())));

Python Script:

 def GetCspNonce():
     """Returns a random nonce."""
     NONCE_LENGTH = 16
     return base64.b64encode(os.urandom(NONCE_LENGTH))


Next Steps Learn more

Now that you have generated a nonce value, the next step is to:
  1. Pass the nonce value to the script-src directive of the Content-Security-Policy header (prepend nonce-).
  2. Pass the same nonce value to the script attribute in the ASAP code snippet.

    Access your files securely from anywhere

      Zoho CRM Training Programs

      Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.

      Zoho CRM Training
        Redefine the way you work
        with Zoho Workplace

          Zoho DataPrep Personalized Demo

          If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.

          Zoho CRM Training

            Create, share, and deliver

            beautiful slides from anywhere.

            Get Started Now


              Zoho Sign now offers specialized one-on-one training for both administrators and developers.

              BOOK A SESSION






                          Quick Links Workflow Automation Data Collection
                          Web Forms Enterprise Begin Data Collection
                          Interactive Forms Workplace Data Collection App
                          Offline Forms Customer Service Accessible Forms
                          Digital Forms Marketing Forms for Small Business
                          HTML Forms Education Forms for Enterprise
                          Contact Forms E-commerce Forms for any business
                          Lead Generation Forms Healthcare Forms for Startups
                          Wordpress Forms Customer onboarding Order Forms for Small Business
                          No Code Forms Construction RSVP tool for holidays
                          Free Forms Travel
                          Prefill Forms Non-Profit

                          Intake Forms Legal

                          Form Designer HR

                          Card Forms Food
                          Assign Forms Photography

                          Translate Forms Real Estate
                          Electronic Forms

                          Notification Emails for Forms Alternatives
                          Holiday Forms Google Forms alternative 
                          Form to PDF Jotform alternative





                                            You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.




                                                Manage your brands on social media

                                                  Zoho Desk Resources

                                                  • Desk Community Learning Series


                                                  • Digest


                                                  • Functions


                                                  • Meetups


                                                  • Kbase


                                                  • Resources


                                                  • Glossary


                                                  • Desk Marketplace


                                                  • MVP Corner


                                                  • Word of the Day


                                                    Zoho Marketing Automation

                                                      Zoho Sheet Resources

                                                       

                                                          Zoho Forms Resources


                                                            Secure your business
                                                            communication with Zoho Mail


                                                            Mail on the move with
                                                            Zoho Mail mobile application

                                                              Stay on top of your schedule
                                                              at all times


                                                              Carry your calendar with you
                                                              Anytime, anywhere




                                                                    Zoho Sign Resources

                                                                      Sign, Paperless!

                                                                      Sign and send business documents on the go!

                                                                      Get Started Now




                                                                              Zoho TeamInbox Resources



                                                                                      Zoho DataPrep Resources



                                                                                        Zoho DataPrep Demo

                                                                                        Get a personalized demo or POC

                                                                                        REGISTER NOW


                                                                                          Design. Discuss. Deliver.

                                                                                          Create visually engaging stories with Zoho Show.

                                                                                          Get Started Now









                                                                                                              • Related Articles

                                                                                                              • Setting up the ASAP Help Widget on the Web

                                                                                                                Introduction The ASAP help widget for websites makes your help center easily available for your end-customers. By embedding this widget with your website, you can provide your customers with easy access to your: Customer support team (to raise ...
                                                                                                              • How to customize the ASAP SDK Android Help Widget UI?

                                                                                                                The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: light and dark. Customized themes You can also override the default dark and light themes to make the SDK look ...
                                                                                                              • How to install an ASAP Help Widget

                                                                                                                The ASAP (App Support Across Platforms) help widget in Zoho Desk is a stand-alone application that provides users with an in-app self-service platform. It works in tandem with your business and allows you to to integrate help center features directly ...
                                                                                                              • How to customize the ASAP SDK iOS Help Widget UI?

                                                                                                                The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: white and black. The following methods help you apply these themes. If you want to change the theme, first ...
                                                                                                              • How to set the welcome message on the ASAP Help Widget

                                                                                                                Specifying the Welcome Message A personalized welcome message can serve as a friendly greeting for customers when they first access your ASAP help widget. You can include a brief introduction about your service and explain how it can benefit them, ...
                                                                                                                Wherever you are is as good as
                                                                                                                your workplace

                                                                                                                  Resources

                                                                                                                  Videos

                                                                                                                  Watch comprehensive videos on features and other important topics that will help you master Zoho CRM.



                                                                                                                  eBooks

                                                                                                                  Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho CRM.



                                                                                                                  Webinars

                                                                                                                  Sign up for our webinars and learn the Zoho CRM basics, from customization to sales force automation and more.



                                                                                                                  CRM Tips

                                                                                                                  Make the most of Zoho CRM with these useful tips.



                                                                                                                    Zoho Show Resources