Generating nonces for the ASAP Help Widget
Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You need to modify the code to generate and pass a nonce value to the script attribute in the ASAP code snippet.
What is a nonce?
A nonce with respect to content security policy is a word or phrase used only once, and it should be so random that they are unpredictable. For example, a nonce should be a cryptographically strong random value that is at least 128 bits in length. It is also necessary that a new nonce is generated for every page load to prevent attackers from injecting arbitrary scripts bypassing CSP.
Why should you use nonces?
When you use CSP, you will need to add a nonce to every inline script block. The nonce lets the browser know that the server intended on serving this script block only if the nonce attribute in the script tag matches the nonce value in the CSP header. This way, you can use it to detect and mitigate the likes of Cross-Site Scripting (XSS) and data injection attacks.
How to generate nonce values?
From your web server, generate a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. Note that you must generate nonces differently each time the page loads (but, nonce only once). Here are some examples:
Nodejs Script:
const var = require( 'crypto' );
var.randomBytes(16).toString( 'base64' );
// '6JDFIvPbrWANKpSJ8vlv6b=='
Java:
String nonce = new String(DigestUtils.md5Hex(String.valueOf(new SecureRandom().nextLong())));
Python Script:
def GetCspNonce():
"""Returns a random nonce."""
NONCE_LENGTH = 16
return base64.b64encode(os.urandom(NONCE_LENGTH))
Now that you have generated a nonce value, the next step is to:
- Pass the nonce value to the script-src directive of the Content-Security-Policy header (prepend nonce-).
- Pass the same nonce value to the script attribute in the ASAP code snippet.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Setting up the ASAP Help Widget on the Web
Introduction The ASAP help widget for websites makes your help center easily available for your end-customers. By embedding this widget with your website, you can provide your customers with easy access to your: Customer support team (to raise ...How to customize the ASAP SDK Android Help Widget UI?
The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: light and dark. Customized themes You can also override the default dark and light themes to make the SDK look ...How to install an ASAP Help Widget
The ASAP (App Support Across Platforms) help widget in Zoho Desk is a stand-alone application that provides users with an in-app self-service platform. It works in tandem with your business and allows you to to integrate help center features directly ...How to customize the ASAP SDK iOS Help Widget UI?
The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: white and black. The following methods help you apply these themes. If you want to change the theme, first ...How to set the welcome message on the ASAP Help Widget
Specifying the Welcome Message A personalized welcome message can serve as a friendly greeting for customers when they first access your ASAP help widget. You can include a brief introduction about your service and explain how it can benefit them, ...
New to Zoho LandingPage?
Zoho LandingPage Resources