csp-nonce-finder.js

function testNonce(nonce) {
  window.okay = false;
  var script = document.createElement('script');
  script.text = 'window.okay = true';
  document.appendChild(script);
  document.removeChild(script);
  return window.okay;
}

function findNonce() {
  var metas = document.getElementsByTagName('meta');
  for (var meta of metas) {
    if (meta.getAttribute('http-equiv') === 'Content-Security-Policy') {
      var nonceRe = /'nonce-([^']+)'/;
      var matches = meta.getAttribute('content').match(nonceRe);
      var nonce = matches[1];
      if (nonce && testNonce(nonce)) {
        return matches[1];
      }
    }
  }
  var scripts = document.getElementsByTagName('script');
  for (var script of scripts) {
    if (script.hasAttribute('nonce')) {
      var nonce = script.getAttribute('nonce');
      if (testNonce(nonce)) {
        return nonce;
      }
    }
  }
}