nonce

For a page whose Content Security Policy allows styles only with the nonce it gives.

Type	string
Default	not set
Live update (update())	No — read once, when the grid is made
Angular	the [nonce] input
<dz-grid>	the settings property: el.settings = { nonce: … }
Declared in	packages/dom/src/settings.ts

What it does

The grid and its features write their layout rules in <style> elements. Under a policy such as style-src 'nonce-r4nd0m', the browser ignores a <style> without that nonce. Give the page’s nonce: the grid puts it on every <style> it writes, its features’ included, and the browser applies them.

The nonce is the server’s, new for each page served; the grid only passes it on. It is read once, when the grid is made: update() refuses a change. A policy that allows no <style> at all needs injectStyles: false instead.

Example

TypeScript

import { createGrid } from '@dzgrid/dom';
import { EN } from '@dzgrid/dom/locales/en';

type Log = { id: string; message: string; level: number };

createGrid<Log>(document.getElementById('logs')!, {
  rows: [{ id: 'l1', message: 'Pump started', level: 1 }],
  columns: [{ id: 'message', header: 'Message' }, { id: 'level', header: 'Level', type: 'number' }],
  getRowId: (l) => l.id,
  messages: EN,
  nonce: document.querySelector<HTMLMetaElement>('meta[name=csp-nonce]')?.content ?? '', // your server writes it in the page
});

Angular

import { Component } from '@angular/core';
import { DzGrid, type DzgColumnOrGroup } from '@dzgrid/angular';
import { EN } from '@dzgrid/dom/locales/en';

type Log = { id: string; message: string; level: number };

@Component({
  selector: 'app-logs',
  imports: [DzGrid],
  template: `<dz-grid [rows]="rows" [columns]="columns" [getRowId]="rowId" [messages]="messages" [nonce]="nonce" />`,
})
export class Logs {
  readonly rows: Log[] = [{ id: 'l1', message: 'Pump started', level: 1 }];
  readonly columns: DzgColumnOrGroup<Log>[] = [{ id: 'message', header: 'Message' }, { id: 'level', header: 'Level', type: 'number' }];
  readonly rowId = (l: Log) => l.id;
  readonly messages = EN;
  readonly nonce = document.querySelector<HTMLMetaElement>('meta[name=csp-nonce]')?.content ?? '';
}

Web Component

import '@dzgrid/element/define';
import type { DzGridElement } from '@dzgrid/element';
import { EN } from '@dzgrid/dom/locales/en';

type Log = { id: string; message: string; level: number };

const grid = document.querySelector<DzGridElement<Log>>('dz-grid')!;
grid.columns = [{ id: 'message', header: 'Message' }, { id: 'level', header: 'Level', type: 'number' }];
grid.getRowId = (l) => l.id;
grid.messages = EN;
grid.settings = { nonce: document.querySelector<HTMLMetaElement>('meta[name=csp-nonce]')?.content ?? '' };
grid.rows = [{ id: 'l1', message: 'Pump started', level: 1 }];

See also

• injectStyles — your page loads the styles itself.