Generating nonces for the ASAP add-on
Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You need to modify the code to generate and pass a nonce value to the script attribute in the ASAP code snippet.
What is a nonce?
A nonce with respect to content security policy is a word or phrase used only once, and it should be so random that they are unpredictable. For example, a nonce should be a cryptographically strong random value that is at least 128 bits in length. It is also necessary that a new nonce is generated for every page load to prevent attackers from injecting arbitrary scripts bypassing CSP.
Why should you use nonces?
When you use CSP, you will need to add a nonce to every inline script block. The nonce lets the browser know that the server intended on serving this script block only if the nonce attribute in the script tag matches the nonce value in the CSP header. This way, you can use it to detect and mitigate the likes of Cross-Site Scripting (XSS) and data injection attacks.
How to generate nonce values?
From your web server, generate a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. Note that you must generate nonces differently each time the page loads (but, nonce only once). Here are some examples:
Nodejs Script:
const var = require( 'crypto' );
var.randomBytes(16).toString( 'base64' );
// '6JDFIvPbrWANKpSJ8vlv6b=='
Java:
String nonce = new String(DigestUtils.md5Hex(String.valueOf(new SecureRandom().nextLong())));
def GetCspNonce():
"""Returns a random nonce."""
NONCE_LENGTH = 16
return base64.b64encode(os.urandom(NONCE_LENGTH))
Next Steps Learn more
Now that you have generated a nonce value, the next step is to:
- Pass the nonce value to the script-src directive of the Content-Security-Policy header (prepend nonce-).
- Pass the same nonce value to the script attribute in the ASAP code snippet.
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Embedding the ASAP Add-On on Sites with a Content Security Policy
Injection-based attacks are some of the most severe and harmful security threats that websites/web apps face. Having a Content Security Policy (CSP) is a powerful way to guard against such attacks. If your website/app has a CSP with the script-src ...Working with the ASAP Add-On for the Web
Introduction The ASAP add-on for websites makes your help center available within quick reach for your end-customers. By embedding this add-on with your website, you can provide your customers with easy access to your: Customer support team (to raise ...Debugging JWT-Related Errors While Configuring the ASAP Add-On
While setting up an ASAP add-on for your web/mobile app, you might encounter an error related to JSON Web Token (JWT) configuration. It is essential to debug this error because user authentication in the ASAP add-on is possible only through JWTs. ...Understanding the enhanced JWT mechanism for Authenticating Users in the ASAP Add-Ons
Types of Users End-users can be categorized as guests or authenticated users based on how they log in to the ASAP add-on. Guest Users Guests are users who do not sign in while logging in to the ASAP add-ons. They can access the Knowledge Base module, ...Working with the ASAP SDK for React Native
The ASAP SDK for React Native makes help available within quick reach for the end-users of your mobile app. Using this SDK, you can add and customize an add-on that resides within your iOS/Android app and provides end-users with easy access to your: ...
New to Zoho LandingPage?
Zoho LandingPage Resources