From 5d642a19a8409b1af12e0c27b572ef024f811bfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B8lve=20T?= <solve@tornoee.com>
Date: Wed, 16 Nov 2022 11:43:18 +0100
Subject: [PATCH] [docs] add nonce placeholder to CSP docs (#7672)

---
 documentation/docs/50-api-reference/10-configuration.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/documentation/docs/50-api-reference/10-configuration.md b/documentation/docs/50-api-reference/10-configuration.md
index d0cd7e134709..dbefdadbdd80 100644
--- a/documentation/docs/50-api-reference/10-configuration.md
+++ b/documentation/docs/50-api-reference/10-configuration.md
@@ -157,6 +157,8 @@ export default config;
 
 ...would prevent scripts loading from external sites. SvelteKit will augment the specified directives with nonces or hashes (depending on `mode`) for any inline styles and scripts it generates.
 
+To add a nonce for scripts and links manually included in `app.html`, you may use the placeholder `%sveltekit.nonce%` (for example `<script nonce="%sveltekit.nonce%">`).
+
 When pages are prerendered, the CSP header is added via a `<meta http-equiv>` tag (note that in this case, `frame-ancestors`, `report-uri` and `sandbox` directives will be ignored).
 
 > When `mode` is `'auto'`, SvelteKit will use nonces for dynamically rendered pages and hashes for prerendered pages. Using nonces with prerendered pages is insecure and therefore forbidden.