Angular · Senior · Question 58 of 75

How do you use a CSP nonce with Angular's inline styles?

✓Correct answer: Set the ngCspNonce attribute on the root element (or provide CSP_NONCE) with a per-request nonce
2Disable CSP for styles
3Angular never adds inline styles

Explanation

Angular inserts component styles at runtime. The nonce must be generated per request on the server and match the Content-Security-Policy header.

Further reading

Angular: Security ↗

Test yourself

Take the Angular · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.