WPT
wpt / content-security-policy / nonce-hiding / script-nonces-hidden.html
Spec: Content Security Policy ↗
Runs: Chrome 155.0.8039.0 (wpt@2b4dfe72c, 2026-09-03) | Firefox 157.0a1 (wpt@2b4dfe72c, 2026-09-03) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-56c61 (wpt@ed1909ed6, 2026-09-03) | Servo Servo 0.6 (wpt@09159dcb3, 2026-09-02) | Blitz 188486089 (wpt@a95401e4e, 2026-09-02)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 12/12 | 12/12 | 12/12 | 10/12 | 11/12 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| Reading 'nonce' content attribute and IDL attribute. | PASS | PASS | PASS | PASS | PASS | — |
| Cloned node retains nonce. | PASS | PASS | PASS | PASS | PASS | — |
| Cloned node retains nonce when inserted. | PASS | PASS | PASS | PASS | PASS | — |
| Writing 'nonce' content attribute. | PASS | PASS | PASS | PASS | PASS | — |
| Writing 'nonce' IDL attribute. | PASS | PASS | PASS | PASS | PASS | — |
| Document-written script executes. | PASS | PASS | PASS | PASS | PASS | — |
| Document-written script's nonce value. | PASS | PASS | PASS | PASS | PASS | — |
| createElement.nonce. | PASS | PASS | PASS | FAIL | FAIL | — |
| setAttribute('nonce') overwrites '.nonce' upon insertion. | PASS | PASS | PASS | PASS | PASS | — |
| createElement.setAttribute. | PASS | PASS | PASS | PASS | PASS | — |
| Custom elements expose the correct events. | PASS | PASS | PASS | FAIL | PASS | — |
| Nonces don't leak via CSS side-channels. | PASS | PASS | PASS | PASS | PASS | — |