title: Why can't I get around my CSP blocking my javascript code in nunjucks when I use a nonce
body: <p>I’m trying to allow the user to return to their previous screen when they get a 404 not found, but my CSP is stopping me.</p>
  <p>Using nonce seems to be the way around it, but I can’t get the blessed thing  to work.</p>
  <p>Ideally, I’d like to add the nonce to my href, but I’m not sure that’s do-able. Alternatively, I’d like to run some javascript from the 404 file, but it doesn’t seem to be picking up the value of my nonce.</p>
  <p>This is how I set up the nonce in helmet-csp:</p>
  <pre><code>app.locals.nonce = crypto.randomBytes(16).toString(&quot;hex&quot;);
  
  app.use(csp({
    directives: {
      defaultSrc: [&quot;'self'&quot;],
      styleSrc: [&quot;'self'&quot;],
      scriptSrc: [&quot;'self'&quot;, `'nonce-${app.locals.nonce}'`],
      imgSrc: [&quot;'self'&quot;],
      fontSrc: [&quot;'self'&quot;]
    }
  }));
  </code></pre>
  <p>In the nunjucks 404 page, I’m trying to go back to previous page:</p>
  <pre><code>{% set n = &quot;nonce-&quot;+nonce %}
  
  &lt;a nonce={{n}} href=&quot;javascript:history.go(-1);&quot;&gt;{{ t('404:goBack')&lt;/a&gt;
  </code></pre>
  <p>And at  the bottom, I have my script tags set up thusly:</p>
  <pre><code>&lt;style nonce=app.locals.nonce&gt;
      console.log('inside 404')
    &lt;/style&gt;
  </code></pre>
  <p>On landing on my 404 page, Chrome spews up the following error:
  eligibilixxxty-sf-debt:38 Refused to execute inline script because it violates the following Content Security Policy directive: &quot;script-src 'self' 'nonce-a8ff45c6cc9b12df8111202f13d1c000'&quot;. Either the 'unsafe-inline' keyword, a hash ('sha256-+6WnXIl4mbFTCARd8N3COQmT3bJJmo32N8q8ZSQAIcU='), or a nonce ('nonce-...') is required to enable inline execution.</p>
  <p>And clicking the href link gets this response:
  Refused to run the JavaScript URL because it violates the following Content Security Policy directive: &quot;script-src 'self' 'nonce-a8ff45c6cc9b12df8111202f13d1c000'&quot;. Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.</p>
  <p>Any ideas where I’m going wrong?</p>