Generating nonces for the ASAP add-on - Zoho Desk Knowledgebase

Generating nonces for the ASAP Help Widget

Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You need to modify the code to generate and pass a nonce value to the script attribute in the ASAP code snippet.

What is a nonce?

A nonce with respect to content security policy is a word or phrase used only once, and it should be so random that they are unpredictable. For example, a nonce should be a cryptographically strong random value that is at least 128 bits in length. It is also necessary that a new nonce is generated for every page load to prevent attackers from injecting arbitrary scripts bypassing CSP.

Why should you use nonces?

When you use CSP, you will need to add a nonce to every inline script block. The nonce lets the browser know that the server intended on serving this script block only if the nonce attribute in the script tag matches the nonce value in the CSP header. This way, you can use it to detect and mitigate the likes of Cross-Site Scripting (XSS) and data injection attacks.

How to generate nonce values?

From your web server, generate a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. Note that you must generate nonces differently each time the page loads (but, nonce only once). Here are some examples:

Nodejs Script:

const var = require( 'crypto' );
var.randomBytes(16).toString( 'base64' );
//  '6JDFIvPbrWANKpSJ8vlv6b=='

Java:

String nonce = new String(DigestUtils.md5Hex(String.valueOf(new SecureRandom().nextLong())));

Python Script:

 def GetCspNonce():
     """Returns a random nonce."""
     NONCE_LENGTH = 16
     return base64.b64encode(os.urandom(NONCE_LENGTH))


Next Steps Learn more

Now that you have generated a nonce value, the next step is to:
  1. Pass the nonce value to the script-src directive of the Content-Security-Policy header (prepend nonce-).
  2. Pass the same nonce value to the script attribute in the ASAP code snippet.

      Create. Review. Publish.

      Write, edit, collaborate on, and publish documents to different content management platforms.

      Get Started Now


        Access your files securely from anywhere

          Zoho CRM Training Programs

          Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.

          Zoho CRM Training
            Redefine the way you work
            with Zoho Workplace

              Zoho DataPrep Personalized Demo

              If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.

              Zoho CRM Training

                Create, share, and deliver

                beautiful slides from anywhere.

                Get Started Now


                  Zoho Sign now offers specialized one-on-one training for both administrators and developers.

                  BOOK A SESSION







                              Quick LinksWorkflow AutomationData Collection
                              Web FormsRetailOnline Data Collection Tool
                              Embeddable FormsBankingBegin Data Collection
                              Interactive FormsWorkplaceData Collection App
                              CRM FormsCustomer ServiceForms for Solopreneurs
                              Digital FormsMarketingForms for Small Business
                              HTML FormsEducationForms for Enterprise
                              Contact FormsE-commerceForms for any business
                              Lead Generation FormsHealthcareForms for Startups
                              Wordpress FormsCustomer onboardingForms for Small Business
                              No Code FormsConstructionRSVP tool for holidays
                              Free FormsTravelFeatures for Order Forms
                              Prefill FormsNon-Profit
                              Forms for Government
                              Intake FormsLegal
                              Mobile App
                              Form DesignerHR
                              Mobile Forms
                              Card FormsFoodOffline Forms
                              Assign FormsPhotographyMobile Forms Features
                              Translate FormsReal EstateKiosk in Mobile Forms
                              Electronic FormsInsurance
                              Drag & drop form builder

                              Notification Emails for FormsAlternativesSecurity & Compliance
                              Holiday FormsGoogle Forms alternative GDPR
                              Form to PDFJotform alternativeHIPAA Forms
                              Email FormsWufoo alternativeEncrypted Forms
                              Accessible FormsTypeform alternativeSecure Forms

                              WCAG

                                          Create. Review. Publish.

                                          Write, edit, collaborate on, and publish documents to different content management platforms.

                                          Get Started Now






                                                            You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.




                                                                Manage your brands on social media

                                                                  Use cases

                                                                  Make the most of Zoho Desk with the use cases.

                                                                   
                                                                    

                                                                  eBooks

                                                                  Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho Desk.

                                                                   
                                                                    

                                                                  Videos

                                                                  Watch comprehensive videos on features and other important topics that will help you master Zoho Desk.

                                                                   
                                                                    

                                                                  Webinar

                                                                  Sign up for our webinars and learn the Zoho Desk basics, from customization to automation and more

                                                                   
                                                                    
                                                                  • Desk Community Learning Series


                                                                  • Meetups


                                                                  • Ask the Experts


                                                                  • Kbase


                                                                  • Resources


                                                                  • Glossary


                                                                  • Desk Marketplace


                                                                  • MVP Corner



                                                                    Zoho Sheet Resources

                                                                     

                                                                        Zoho Forms Resources


                                                                          Secure your business
                                                                          communication with Zoho Mail


                                                                          Mail on the move with
                                                                          Zoho Mail mobile application

                                                                            Stay on top of your schedule
                                                                            at all times


                                                                            Carry your calendar with you
                                                                            Anytime, anywhere




                                                                                  Zoho Sign Resources

                                                                                    Sign, Paperless!

                                                                                    Sign and send business documents on the go!

                                                                                    Get Started Now




                                                                                            Zoho TeamInbox Resources





                                                                                                      Zoho DataPrep Demo

                                                                                                      Get a personalized demo or POC

                                                                                                      REGISTER NOW


                                                                                                        Design. Discuss. Deliver.

                                                                                                        Create visually engaging stories with Zoho Show.

                                                                                                        Get Started Now










                                                                                                                            • Related Articles

                                                                                                                            • Setting up the ASAP Help Widget on the Web

                                                                                                                              Introduction The ASAP help widget for websites makes your help center easily available for your end-customers. By embedding this widget with your website, you can provide your customers with easy access to your: Customer support team (to raise ...
                                                                                                                            • How to customize the ASAP SDK Android Help Widget UI?

                                                                                                                              The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: light and dark. Customized themes You can also override the default dark and light themes to make the SDK look ...
                                                                                                                            • How to install an ASAP Help Widget

                                                                                                                              The ASAP (App Support Across Platforms) help widget in Zoho Desk is a stand-alone application that provides users with an in-app self-service platform. It works in tandem with your business and allows you to to integrate help center features directly ...
                                                                                                                            • How to customize the ASAP SDK iOS Help Widget UI?

                                                                                                                              The ASAP SDK allows you to customize the UI of the help widget as required. Predefined themes The SDK UI comes with two predefined themes: white and black. The following methods help you apply these themes. If you want to change the theme, first ...
                                                                                                                            • How to set the welcome message on the ASAP Help Widget

                                                                                                                              Specifying the Welcome Message A personalized welcome message can serve as a friendly greeting for customers when they first access your ASAP help widget. You can include a brief introduction about your service and explain how it can benefit them, ...
                                                                                                                              Wherever you are is as good as
                                                                                                                              your workplace

                                                                                                                                Resources

                                                                                                                                Videos

                                                                                                                                Watch comprehensive videos on features and other important topics that will help you master Zoho CRM.



                                                                                                                                eBooks

                                                                                                                                Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho CRM.



                                                                                                                                Webinars

                                                                                                                                Sign up for our webinars and learn the Zoho CRM basics, from customization to sales force automation and more.



                                                                                                                                CRM Tips

                                                                                                                                Make the most of Zoho CRM with these useful tips.



                                                                                                                                  Zoho Show Resources