Nonce caching/generation on edge proxies or CDNs

### MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

### What specific section or headline is this issue about?

Nonce caching

### What information was incorrect, unhelpful, or incomplete?

Hi there 👋 , it's the Django community again :)

[CSP 3 states that the nonce MUST be random on each transmission.](https://www.w3.org/TR/CSP3/#security-nonces)

This is reflected in the docs here: https://github.com/mdn/content/blob/3b8fdeeaa5b96796870166b989de523261e5fc05/files/en-us/web/http/guides/csp/index.md?plain=1#L184

However, in relation to [RFC 7234](https://httpwg.org/specs/rfc7234.html) caches, this would mean that proxies MUST not cache pages if a [nonce-source](https://www.w3.org/TR/CSP3/#grammardef-nonce-source) expression is present in the policy.

### What did you expect to see?

I'd love to see some clarification on how applications should or rather SHOULDN'T handle this.

The discussion was sparked as part of https://github.com/django/django/pull/21010#pullrequestreview-4235130467 and whether Django should set an additional explicit `Cache-Control` header.

My understanding of CSP is that this is NOT needed, as the standard is pretty clear on what a nonce needs to be.

### Do you have any supporting links, references, or citations?

_No response_

### Do you have anything more you want to share?

I don't believe this affects the security of browsers like FF, since client caching nonces is safe anyway. As nonce generation is limited to transmissions.

### MDN metadata

Page report details

* Folder: `en-us/web/http/guides/csp`
* MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
* GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/http/guides/csp/index.md
* Last commit: https://github.com/mdn/content/commit/6720d579bd658f02c56363805e97e69f93dc79f1
* Document last modified: 2026-03-22T23:36:38.000Z