# csp

URL: /kida/api/utils/csp/
Section: utils
Description: Content Security Policy (CSP) nonce injection.

Auto-injects ``nonce="..."`` into ``<script>`` and ``<style>`` tags for
CSP compliance. Works as a post-processing step on rendered HTML.

Usage via RenderContext metadata::

    from kida.render_context import render_context

    with render_context() as ctx:
        ctx.set_meta("csp_nonce", "abc123")
        html = template.render(**data)
    # All <script> and <style> tags now have nonce="abc123"

Usage as a filter::

    {{ content | csp_nonce("abc123") }}

Usage as a standalone function::

    from kida.utils.csp import inject_csp_nonce
    safe_html = inject_csp_nonce(html, "abc123")

---

> For a complete page index, fetch /kida/llms.txt.

Open LLM text
(/kida/api/utils/csp/index.txt)

Share with AI

Ask Claude
(https://claude.ai/new?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fkida%2Fapi%2Futils%2Fcsp%2Findex.txt)

Ask ChatGPT
(https://chatgpt.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fkida%2Fapi%2Futils%2Fcsp%2Findex.txt)

Ask Gemini
(https://gemini.google.com/app?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fkida%2Fapi%2Futils%2Fcsp%2Findex.txt)

Ask Copilot
(https://copilot.microsoft.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fkida%2Fapi%2Futils%2Fcsp%2Findex.txt)

Module

#
`utils.csp`

Content Security Policy (CSP) nonce injection.

Auto-injects`nonce="..."` into `<script>` and `<style>`tags for
CSP compliance. Works as a post-processing step on rendered HTML.

Usage via RenderContext metadata::

```
from kida.render_context import render_context

with render_context() as ctx:
    ctx.set_meta("csp_nonce", "abc123")
    html = template.render(**data)
# All <script> and <style> tags now have nonce="abc123"
```

Usage as a filter::

```
{{ content | csp_nonce("abc123") }}
```

Usage as a standalone function::

```
from kida.utils.csp import inject_csp_nonce
safe_html = inject_csp_nonce(html, "abc123")
```

3Functions

## Functions

`inject_csp_nonce`

2

`str`

▼

Inject CSP nonce into all and tags.

Adds ``nonce="..."`` to every ```` and `…

`def inject_csp_nonce(html_content: str, nonce: str) -> str`

Inject CSP nonce into all