getAttribute('nonce') works in Firefox, but not Chrome

Given I am loading a script like this:

<script nonce="35609alksdgx30q" src="example.com/main.js"></script>


And inside main.js I need to grab the nonce on the script tag:

main.js

const currentScriptElement = document.currentScript
const nonce = currentScriptElement.getAttribute('nonce')


If console.log(nonce), I get two different values:

console.log(nonce)

35609alksdgx30q

""

If I get the nonce using the experimental nonce property (HTMLElement.nonce), I get the following values:

null

35609alksdgx30q

So to reliably get the nonce, I have to do something like this:

const nonce = currentScript.nonce || currentScript.getAttribute('nonce') || false


My question is, why doesn't getAttribute('nonce') consistently return the nonce value? I suspect this is a security thing, but then why doesn't Firefox also return an empty string when using getAttribute('nonce')?

getAttribute('nonce')

getAttribute('nonce')

Yes, I know technically nonce is used for inline scripts, and yes this script is cleared by the site's CSP policy. I have to grab nonce this way due to how some things were implemented xD

nonce

nonce

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.