Csp Nonce Source Token Tool

Description

Wrap it as a quoted nonce sourceToken.

HTTP response headers and content-security tokens carry separate pieces of a browser policy. Recognizing one directive or formatting one token does not establish that the complete policy is valid or effective.

Wrap it as a quoted nonce sourceToken.

When to use this tool

Use Csp Nonce Source Token when you need a narrowly scoped header component check or formatter before assembling and testing a complete response policy.

How to use the tool and how it works

Enter nonceBase64. Use the units and conventions below.
Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
Read sourceToken. Use the output convention below.

Require nonceBase64 to contain one or more allowed base64-style letters, digits, plus, slash, underscore, or hyphen with up to two terminal equals signs. Wrap it as a quoted nonce sourceToken.^[1]

The draft defines a quoted nonce-source token and separately requires a fresh policy nonce. This formatter checks spelling; generating an unpredictable per-response value remains the caller's responsibility.^[2]

Input field	Meaning and units	Accepted input
nonceBase64	Nonce Base64	Required. Text; maximum UTF-16 length 8192.

Output field	Interpretation	Returned shape
sourceToken	Source Token	Required. Text; maximum UTF-16 length 8192.

json

{
  "input": {
    "nonceBase64": "YWJjZA=="
  },
  "output": {
    "sourceToken": "'nonce-YWJjZA=='"
  }
}

Limitations and assumptions

The shape check does not decode base64, generate randomness, establish nonce entropy, or configure a CSP header.
Inputs must satisfy both the field types and the cross-field conditions above. Invalid input causes an error; a successful false flag or documented placeholder is a different result.

Alternative or Complementary methods

Parse the complete header and test its behavior in the intended browser when policy effectiveness matters.

References

Similar or alternative tools

web/csp-parser
A serialized Content Security Policy contains semicolon-separated directives with whitespace-separated values.
HSTS Include Sub Domains Flag
Reject CR/LF and split headerValue at semicolons outside quoted strings, respecting backslash escapes inside quotes.