Whether value can be a Content-Security-Policy nonce: a non-empty string
of CSP3's base64-value, 1*( ALPHA / DIGIT / "+" / "/" / "-" / "_" ) *2( "=" ), which is what a policy's 'nonce-<value>' source holds between
'nonce- and the closing quote. No other value can match a nonce source.
The check is on form only: a value that kept its nonce- prefix still fits
the grammar, yet matches no policy naming the value itself.
Whether
valuecan be a Content-Security-Policy nonce: a non-empty string of CSP3's base64-value,1*( ALPHA / DIGIT / "+" / "/" / "-" / "_" ) *2( "=" ), which is what a policy's'nonce-<value>'source holds between'nonce-and the closing quote. No other value can match a nonce source. The check is on form only: a value that kept itsnonce-prefix still fits the grammar, yet matches no policy naming the value itself.