diff --git a/docs/api-docs/storefront/scripts-overview.mdx b/docs/api-docs/storefront/scripts-overview.mdx index 3c103a02c..3f119e6e7 100644 --- a/docs/api-docs/storefront/scripts-overview.mdx +++ b/docs/api-docs/storefront/scripts-overview.mdx @@ -139,16 +139,13 @@ You can add up to five SRI hashes and remove hashes when they are no longer vali [Content Security Policy (CSP)]() is a standard that uses [`nonce` global attributes]() to allowlist non-static inline scripts. -Since inline scripts may contain dynamic handlebar template variables, BigCommerce uses `nonce` values instead of `intgrity` hashes to validate inline scripts. Browsers first check for `integrity` hashes before checking `nonce` values. +Since inline scripts may contain dynamic handlebar template variables, BigCommerce uses `nonce` values instead of `integrity` hashes to validate inline scripts. Browsers first check for `integrity` hashes before checking `nonce` values. The `nonce` attribute in the `script` tag has a uniquely generated value. -On every page load, BigCommerce generates a nonce value and passes it to browsers through the HTTP `Content-Security-Policy` response header. -For any scripts that the merchant adds through Script Manager or the Scripts API, BigCommerce automatically injects the nonce value for them on every page load. - - -If you are editing custom scripts in the Stencil theme files (i.e. outside of script manager or the Scripts API), you need to add a nonce handlebar. -E.g. added script to checkout page. +On every page load, BigCommerce generates a `nonce` value and passes it to browsers through the HTTP `Content-Security-Policy` response header. +For any scripts that the merchant adds through Script Manager or the Scripts API, BigCommerce automatically injects the `nonce` value for them on every page load. +If you are editing custom scripts in the Stencil theme files (i.e. outside of Script Manager or the Scripts API), you need to add a `nonce` handlebar. ## Troubleshooting