Title: Adding Nonce in Extra js script
Last modified: March 3, 2023

---

# Adding Nonce in Extra js script

 *  [Lukman Nakib](https://wordpress.org/support/users/pyrobd/)
 * (@pyrobd)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/)
 *  I need to add nonce to these extra scripts but could not find any
    filter,client
   site is blocking inline scripts without nonce. Here is a screenshot [https://prnt.sc/DFKGjyEit4UD](https://prnt.sc/DFKGjyEit4UD).
   Is is possible ?

Viewing 9 replies - 1 through 9 (of 9 total)

 *  [Sanjeev Aryal](https://wordpress.org/support/users/sanzeeb3/)
 * (@sanzeeb3)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16523576)
 * You probably need to know the name of the nonce that script handle is using. 
   Nonce can be created with [wp_create_nonce()](https://developer.wordpress.org/reference/functions/wp_create_nonce/)
 * Example:
 *     ```wp-block-code
       wp_add_inline_script( 
       	'script-handle',
       	'const my_script_params = ' . json_encode( 
       			array(
       				'ajax_url'   => admin_url( 'admin-ajax.php' ),
       				'my_nonce'   => wp_create_nonce( 'my_nonce' )
       			)		
       	),
       	'before' 
       );
       ```
   
 *  Thread Starter [Lukman Nakib](https://wordpress.org/support/users/pyrobd/)
 * (@pyrobd)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16524452)
 * Actually I am not adding a new inline script, I already a registered a script
   source then added some variables using wp_localize_script() for that script. 
   Then the localized variable are loaded as inline script and I can not add any
   nonce to it, I can add nonce or attributes to main registered script thought,
   please check my screenshot. 
   Hope you understood the issue.
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16525968)
 * The way to add a nonce value to inline script is through wp_localize_script()
   or wp_add_inline_script() like Sanjeev suggested. They both work in a similar
   manner. Since you already use wp_localize_script(), just add a nonce value to
   the list of passed vars. These are global values, so it doesn’t matter much which
   script handle you use to localize. It does have to be a valid handle enqueued
   for the page.
 * The nonce value does need to be coordinated with the server script that validates
   the nonce. The $action arg passed to wp_create_nonce() has to match that which
   the validation script is using.
 *  Thread Starter [Lukman Nakib](https://wordpress.org/support/users/pyrobd/)
 * (@pyrobd)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16530705)
 * I understood what you are saying , but I need to add this as a script tag attribute,
   if I do as you say, it will work the global values will be inside the script ,
   as script content but what I need is a script tag attribute like this 
   `<script
   my-custom-attr="my-value"> //content </script>`The way your are suggesting will
   work like the following`<script > my-custom-attr="my-value" </script>`
 * Hope it is clear now, could find a way for this anywhere.
 * Thanks again
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16533693)
 * You can use the [‘wp_script_attributes’](https://developer.wordpress.org/reference/hooks/wp_script_attributes/)
   to add extra script tag attributes. Your callback is passed an array of any other
   attributes already in place, which should include the ID attribute for the specific
   script tag you are targeting.
 *  Thread Starter [Lukman Nakib](https://wordpress.org/support/users/pyrobd/)
 * (@pyrobd)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16534860)
 * Thank you but I already found this and the problem is  [‘wp_script_attributes’](https://developer.wordpress.org/reference/hooks/wp_script_attributes/)
   it does not get called when I use wp_localize_script function or registering 
   a script. So it does not work.
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16536847)
 * Hmmm… That filter doesn’t seem to be used at all. I wonder what that’s about.
 * Anyway, you could output the entire HTML script block from the [“wp_print_scripts”](https://developer.wordpress.org/reference/hooks/wp_print_scripts/)
   action. Doing it this way means any dependencies cannot be properly managed, 
   but by using appropriate $priority values when adding your callback, you can 
   at least manage whether the output occurs early or late.
 *  Thread Starter [Lukman Nakib](https://wordpress.org/support/users/pyrobd/)
 * (@pyrobd)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16542214)
 * Should not   [‘wp_script_attributes](https://developer.wordpress.org/reference/hooks/wp_script_attributes/)‘
   filter should be able to filter script tag attributes, if not why not add the
   support for it, if it does not get called up I am confused about the use this
   filter
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16544259)
 * One would think. It’ll take some digging to figure out where it actually is used,
   or more importantly, why it’s not used on many scripts. It might be an actual
   bug, but I don’t have time right now to investigate further (I’m in travel mode,
   sitting at a departure gate).

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Adding Nonce in Extra js script’ is closed to new replies.

 * In: [Developing with WordPress](https://wordpress.org/support/forum/wp-advanced/)
 * 9 replies
 * 3 participants
 * Last reply from: [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * Last activity: [3 years, 2 months ago](https://wordpress.org/support/topic/adding-nonce-in-extra-js-script/#post-16544259)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics