diff --git a/contributing-frontend.md b/contributing-frontend.md
index 5a6a203ea86..76fd8a2fde7 100644
--- a/contributing-frontend.md
+++ b/contributing-frontend.md
@@ -19,7 +19,7 @@ A react root element (or the first container element within it) must include the
 If your react component isn't dependent on any Knockout observables or Vue components you can integrate it by adding a small script and a component reference directly in the HTML code. The following example integrates MyComponent as a react root in an HTML/mako file.
 
 ```HTML
-<script type="text/javascript">
+<script type="text/javascript" nonce="${ request.csp_nonce }">
   (function () {
     window.createReactComponents('#some-container');
   })();
diff --git a/desktop/conf.dist/hue.ini b/desktop/conf.dist/hue.ini
index 2ea34fd5c1d..8edd7359576 100644
--- a/desktop/conf.dist/hue.ini
+++ b/desktop/conf.dist/hue.ini
@@ -137,6 +137,9 @@ http_500_debug_mode=false
 # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
 ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googletagmanager.com *.doubleclick.net data:;img-src 'self' *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;style-src 'self' 'unsafe-inline' fonts.googleapis.com;connect-src 'self' *.google-analytics.com;frame-src *;child-src 'self' data: *.vimeo.com;object-src 'none'"
 
+# Enable nonce attribute to remove unsafe-inline and auto remove unsafe-inline from csp 
+## csp_nonce=True
+
 # Strict-Transport-Security HTTP Strict Transport Security(HSTS) is a policy which is communicated by the server to the user agent via HTTP response header field name "Strict-Transport-Security". HSTS policy specifies a period of time during which the user agent(browser) should only access the server in a secure fashion(https).
 ## secure_ssl_redirect=False
 ## secure_redirect_host=0.0.0.0
diff --git a/desktop/core/src/desktop/conf.py b/desktop/core/src/desktop/conf.py
index f788adfbdeb..070a8d4884e 100644
--- a/desktop/core/src/desktop/conf.py
+++ b/desktop/core/src/desktop/conf.py
@@ -395,6 +395,18 @@ def has_ssl_no_renegotiation():
           "child-src 'self' data: *.vimeo.com;" +
           "object-src 'none'")
 
+
+CSP_NONCE = Config(
+  key="csp_nonce",
+  help=_(
+    'Enables or disables the use of a cryptographic nonce in Content Security '
+    'Policy headers. When set to true, a unique nonce will be generated for each '
+    'request, and used in scripts and styles'
+  ),
+  type=coerce_bool,
+  default=False)
+
+
 SECURE_SSL_REDIRECT = Config(
   key="secure_ssl_redirect",
   help=_('If all non-SSL requests should be permanently redirected to SSL.'),
diff --git a/desktop/core/src/desktop/js/onePageViewModel.js b/desktop/core/src/desktop/js/onePageViewModel.js
index 6cc5db2a3fa..a28f905d5de 100644
--- a/desktop/core/src/desktop/js/onePageViewModel.js
+++ b/desktop/core/src/desktop/js/onePageViewModel.js
@@ -256,7 +256,12 @@ class OnePageViewModel {
           const nextScriptPromise = scriptPromises.shift();
           nextScriptPromise.done(scriptDetails => {
             if (scriptDetails.contents) {
-              $.globalEval(scriptDetails.contents);
+              // $.globalEval(scriptDetails.contents);
+              const nonce = window.nonce || '';  // Fallback to an empty string if nonce is not defined
+              const script = document.createElement('script');
+              script.setAttribute('nonce', nonce);  // Set the nonce attribute more explicitly
+              script.text = scriptDetails.contents;
+              document.head.appendChild(script).parentNode.removeChild(script);
             }
             evalScriptSync();
           });
@@ -386,6 +391,11 @@ class OnePageViewModel {
               self.extraEmbeddableURLParams('');
 
               self.processHeaders(response).done($rawHtml => {
+                const nonce = window.nonce || ''; 
+                const scripts = $rawHtml.find('script');
+                scripts.each(function() {
+                  this.setAttribute('nonce', nonce);
+                });
                 if (window.SKIP_CACHE.indexOf(app) === -1) {
                   self.embeddable_cache[app] = $rawHtml;
                 }
diff --git a/desktop/core/src/desktop/lib/django_util.py b/desktop/core/src/desktop/lib/django_util.py
index 21bd933f118..6ac5ed35cf1 100644
--- a/desktop/core/src/desktop/lib/django_util.py
+++ b/desktop/core/src/desktop/lib/django_util.py
@@ -502,3 +502,12 @@ def __init__(self, data, encoder=DjangoJSONEncoder, safe=True,
     kwargs.setdefault('content_type', 'application/json')
     data = json.dumps(data, cls=encoder, **json_dumps_params)
     super(JsonResponse, self).__init__(content=data, **kwargs)
+
+
+def nonce_attribute(request):
+    # Assuming 'csp_nonce' is set in the request and CSP_NONCE controls its usage
+    if desktop.conf.CSP_NONCE.get():
+        csp_nonce = request.csp_nonce
+        if csp_nonce:
+            return f' nonce={csp_nonce}'
+    return ''
\ No newline at end of file
diff --git a/desktop/core/src/desktop/middleware.py b/desktop/core/src/desktop/middleware.py
index 426677ea971..05ecb8adde7 100644
--- a/desktop/core/src/desktop/middleware.py
+++ b/desktop/core/src/desktop/middleware.py
@@ -18,6 +18,7 @@
 from __future__ import absolute_import
 
 from builtins import object
+import base64
 import inspect
 import json
 import logging
@@ -29,6 +30,7 @@
 import tempfile
 import time
 import traceback
+import secrets
 
 import kerberos
 import django.db
@@ -54,7 +56,7 @@
 from desktop.auth.backend import is_admin, find_or_create_user, ensure_has_a_group, rewrite_user
 from desktop.conf import AUTH, HTTP_ALLOWED_METHODS, ENABLE_PROMETHEUS, KNOX, DJANGO_DEBUG_MODE, AUDIT_EVENT_LOG_DIR, \
     METRICS, SERVER_USER, REDIRECT_WHITELIST, SECURE_CONTENT_SECURITY_POLICY, has_connectors, is_gunicorn_report_enabled, \
-    CUSTOM_CACHE_CONTROL, HUE_LOAD_BALANCER
+    CUSTOM_CACHE_CONTROL, HUE_LOAD_BALANCER, CSP_NONCE
 from desktop.context_processors import get_app_name
 from desktop.lib import apputil, i18n, fsmanager
 from desktop.lib.django_util import JsonResponse, render, render_json
@@ -68,6 +70,69 @@
 
 from libsaml.conf import CDP_LOGOUT_URL
 from urllib.parse import urlparse
+import os
+
+
+def nonce_exists(response):
+    """Check for preexisting nonce in style and script.
+
+     Args:
+         response (:obj:): Django response object
+
+     Returns:
+         nonce_found (dict): Dictionary of nonces found
+     """
+    try:
+        csp = response['Content-Security-Policy']
+    except KeyError:
+        csp = response.get('Content-Security-Policy-Report-Only', '')
+
+    nonce_found = {}
+
+    if csp:
+        csp_split = csp.split(';')
+        for directive in csp_split:
+            if 'nonce-' not in directive:
+                continue
+            if 'script-src' in directive:
+                nonce_found['script'] = directive
+            if 'style-src' in directive:
+                nonce_found['style'] = directive
+
+    return nonce_found
+
+def get_header(response):
+    """Get the CSP header type.
+
+    This is basically a check for:
+        Content-Security-Policy or Content-Security-Policy-Report-Only
+
+    Args:
+        response (:obj:): Django response object
+
+    Returns:
+         dict:
+            name: CPS header policy. i.e. Report-Only or not
+            csp: CSP directives associated with the header
+            bool: False if neither policy header is found
+    """
+    policies = [
+        "Content-Security-Policy",
+        "Content-Security-Policy-Report-Only"
+    ]
+
+    try:
+        name = policies[0]
+        csp = response[policies[0]]
+    except KeyError:
+        try:
+            name = policies[1]
+            csp = response[policies[1]]
+        except KeyError:
+            return False
+
+    return {'name': name, 'csp': csp}
+
 
 if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
@@ -900,19 +965,57 @@ def process_response(self, request, response):
 
 
 class ContentSecurityPolicyMiddleware(MiddlewareMixin):
-  def __init__(self, get_response):
-    self.get_response = get_response
-    self.secure_content_security_policy = SECURE_CONTENT_SECURITY_POLICY.get()
-    if not self.secure_content_security_policy:
-      LOG.info('Unloading ContentSecurityPolicyMiddleware')
-      raise exceptions.MiddlewareNotUsed
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.secure_content_security_policy = SECURE_CONTENT_SECURITY_POLICY.get()
+        if not self.secure_content_security_policy:
+            logger.info('Unloading ContentSecurityPolicyMiddleware')
+            raise exceptions.MiddlewareNotUsed
+
+    def process_request(self, request):
+        nonce = secrets.token_urlsafe()
+        request.csp_nonce = nonce
+
+    def process_response(self, request, response):
+        if self.secure_content_security_policy and 'Content-Security-Policy' not in response:
+            response["Content-Security-Policy"] = self.secure_content_security_policy
+        
+        if not CSP_NONCE.get():
+          return response
+
+
+        header = get_header(response)
+        if not header or not hasattr(request, 'csp_nonce'):
+            return response
+
+        nonce_found = nonce_exists(response)
+        has_nonce = bool(nonce_found)
+        if has_nonce:
+            logger.error("Nonce already exists: {}".format(nonce_found))
+            return response
+
+        nonce = getattr(request, 'csp_nonce', None)
+        csp_split = header['csp'].split(';')
+        new_csp = []
+        nonce_directive = f"'nonce-{nonce}'" if nonce else ''
+
+        for p in csp_split:
+            directive = p.lstrip().split(' ')[0]
+            if nonce:
+                # Remove unsafe-inline from scripts
+                # TODO remove unsafe-inline from styles
+                if directive in ('script-src'):
+                    new_directive_parts = [part for part in p.split(' ') if part and part != "'unsafe-inline'"]
+                    new_directive_parts.append(nonce_directive)
+                    new_csp.append(' '.join(new_directive_parts))
+                else:
+                    new_csp.append(p)
+            else:
+                new_csp.append(p)
 
-  def process_response(self, request, response):
-    if self.secure_content_security_policy and not 'Content-Security-Policy' in response:
-      response["Content-Security-Policy"] = self.secure_content_security_policy
-
-    return response
+        response[header['name']] = "; ".join(new_csp).strip() + ';'
 
+        return response
 
 class MimeTypeJSFileFixStreamingMiddleware(MiddlewareMixin):
   """
diff --git a/desktop/core/src/desktop/settings.py b/desktop/core/src/desktop/settings.py
index ca0f93188a4..aac8311f35d 100644
--- a/desktop/core/src/desktop/settings.py
+++ b/desktop/core/src/desktop/settings.py
@@ -240,7 +240,7 @@
   'django.template.context_processors.request',
   'django.contrib.messages.context_processors.messages',
    # Not default
-  'desktop.context_processors.app_name',
+  'desktop.context_processors.app_name'
 )
 
 TEMPLATES = [
diff --git a/desktop/core/src/desktop/templates/common_footer.mako b/desktop/core/src/desktop/templates/common_footer.mako
index d80aa2c546b..7053f3622e4 100644
--- a/desktop/core/src/desktop/templates/common_footer.mako
+++ b/desktop/core/src/desktop/templates/common_footer.mako
@@ -24,6 +24,8 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
+
+from desktop.lib.django_util import nonce_attribute
 %>
 
 <%namespace name="commonHeaderFooterComponents" file="/common_header_footer_components.mako" />
@@ -34,7 +36,7 @@ ${ smart_unicode(login_modal(request).content) | n,unicode }
 
 <iframe id="zoomDetectFrame" style="width: 250px; display: none" ></iframe>
 
-${ commonHeaderFooterComponents.footer(messages) }
+${ commonHeaderFooterComponents.footer(messages, nonce_attribute(request) ) }
 
   </body>
 </html>
diff --git a/desktop/core/src/desktop/templates/common_header.mako b/desktop/core/src/desktop/templates/common_header.mako
index 78dce8825c0..e844a9c744d 100644
--- a/desktop/core/src/desktop/templates/common_header.mako
+++ b/desktop/core/src/desktop/templates/common_header.mako
@@ -30,7 +30,7 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
-
+from desktop.lib.django_util import nonce_attribute
 home_url = url('desktop_views_home')
 if USE_NEW_EDITOR.get():
   home_url = url('desktop_views_home2')
@@ -89,7 +89,7 @@ if USE_NEW_EDITOR.get():
   <link href="${ static('desktop/css/hue3.css') }" rel="stylesheet">
   <link href="${ static('desktop/css/hue3-extra.css') }" rel="stylesheet">
 
-  <style type="text/css">
+  <style ${nonce_attribute(request)} type="text/css">
     % if banner_message or conf.CUSTOM.BANNER_TOP_HTML.get():
       body {
         display: none;
@@ -142,24 +142,24 @@ if USE_NEW_EDITOR.get():
   <%
     global_constants_url = '/desktop/globalJsConstants.js?v=' + hue_version()
   %>
-  <script src="${global_constants_url}"></script>
+  <script ${nonce_attribute(request)} src="${global_constants_url}"></script>
   % endif
 
   % if not conf.DEV.get():
-  <script src="${ static('desktop/js/hue.errorcatcher.js') }"></script>
+  <script ${nonce_attribute(request)} src="${ static('desktop/js/hue.errorcatcher.js') }"></script>
   % endif
 
   % for bundle in get_hue_bundles('login' if section == 'login' else 'hue', 'LOGIN' if section == 'login' else 'DEFAULT'):
     ${ render_bundle(bundle, config='LOGIN' if section == 'login' else 'DEFAULT') | n,unicode }
   % endfor
 
-  <script src="${ static('desktop/js/bootstrap-tooltip.js') }"></script>
-  <script src="${ static('desktop/js/bootstrap-typeahead-touchscreen.js') }"></script>
-  <script src="${ static('desktop/ext/js/bootstrap-better-typeahead.min.js') }"></script>
-  <script src="${ static('desktop/js/popover-extra-placements.js') }"></script>
-  <script src="${ static('desktop/ext/js/moment-with-locales.min.js') }"></script>
-  <script src="${ static('desktop/ext/js/moment-timezone-with-data.min.js') }" type="text/javascript" charset="utf-8"></script>
-  <script src="${ static('desktop/ext/js/tzdetect.js') }" type="text/javascript" charset="utf-8"></script>
+  <script ${nonce_attribute(request)} src="${ static('desktop/js/bootstrap-tooltip.js') }"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/js/bootstrap-typeahead-touchscreen.js') }"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/bootstrap-better-typeahead.min.js') }"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/js/popover-extra-placements.js') }"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/moment-with-locales.min.js') }"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/moment-timezone-with-data.min.js') }" type="text/javascript" charset="utf-8"></script>
+  <script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/tzdetect.js') }" type="text/javascript" charset="utf-8"></script>
 
 % if user.is_authenticated:
   ${ hueAceAutocompleter.hueAceAutocompleter() }
@@ -168,9 +168,9 @@ if USE_NEW_EDITOR.get():
   ${ commonHeaderFooterComponents.header_pollers(user, is_s3_enabled, apps) }
 
 % if user.is_authenticated:
-  <script src="${ static('desktop/ext/js/localforage.min.js') }"></script>
+  <script ${nonce_attribute(request)} src="${ static('desktop/ext/js/localforage.min.js') }"></script>
 
-  <script type="text/javascript">
+  <script ${nonce_attribute(request)} type="text/javascript">
     $(document).ready(function () {
       localforage.config({
         version: 1.0,
@@ -200,7 +200,7 @@ ${ hueIcons.symbols() }
 
 
 % if hasattr(request, 'environ') and request.environ.get("PATH_INFO").find("/hue/") < 0:
-  <script>
+  <script  ${nonce_attribute(request)}>
     window.location.replace(window.HUE_BASE_URL || "/");
   </script>
 % endif
@@ -556,8 +556,8 @@ ${ hueIcons.symbols() }
   </ul>
 
   <!-- UserVoice JavaScript SDK -->
-  <script>(function(){var uv=document.createElement('script');uv.type='text/javascript';uv.async=true;uv.src='//widget.uservoice.com/8YpsDfIl1Y2sNdONoLXhrg.js';var s=document.getElementsByTagName('script')[0];s.parentNode.insertBefore(uv,s)})()</script>
-  <script>
+  <script ${nonce_attribute(request)}>(function(){var uv=document.createElement('script');uv.type='text/javascript';uv.async=true;uv.src='//widget.uservoice.com/8YpsDfIl1Y2sNdONoLXhrg.js';var s=document.getElementsByTagName('script')[0];s.parentNode.insertBefore(uv,s)})()</script>
+  <script ${nonce_attribute(request)}>
   UserVoice = window.UserVoice || [];
   function showClassicWidget() {
     UserVoice.push(['showLightbox', 'classic_widget', {
diff --git a/desktop/core/src/desktop/templates/common_header_footer_components.mako b/desktop/core/src/desktop/templates/common_header_footer_components.mako
index 5be3e6c6f80..d81ccb97653 100644
--- a/desktop/core/src/desktop/templates/common_header_footer_components.mako
+++ b/desktop/core/src/desktop/templates/common_header_footer_components.mako
@@ -30,10 +30,11 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
+from desktop.lib.django_util import nonce_attribute
 %>
 
 <%def name="header_pollers(user, is_s3_enabled, apps)">
-  <script type="text/javascript">
+  <script ${nonce_attribute(request)} type="text/javascript">
     Dropzone.autoDiscover = false;
     moment.locale(window.navigator.userLanguage || window.navigator.language);
     localeFormat = function (time) {
@@ -230,7 +231,7 @@ else:
 
 </%def>
 
-<%def name="footer(messages)">
+<%def name="footer(messages, nonce)">
 
 <div id="progressStatus" class="uploadstatus well hide">
   <h4>${ _('Upload progress') }</h4>
@@ -267,7 +268,7 @@ else:
 
 <div class="clipboard-content"></div>
 
-<script type="text/javascript">
+<script ${nonce_attribute(request)} type="text/javascript">
 
   $(document).ready(function () {
 
diff --git a/desktop/core/src/desktop/templates/common_notebook_ko_components.mako b/desktop/core/src/desktop/templates/common_notebook_ko_components.mako
index 26df0258c97..2166b82f4bc 100644
--- a/desktop/core/src/desktop/templates/common_notebook_ko_components.mako
+++ b/desktop/core/src/desktop/templates/common_notebook_ko_components.mako
@@ -29,6 +29,7 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
+from desktop.lib.django_util import nonce_attribute
 %>
 
 
@@ -74,7 +75,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script type="text/javascript"  ${nonce_attribute(request)}>
     (function () {
       var WHEEL_RADIUS = 75;
       var PLUS_ICON_RADIUS = 27.859; // FA-5X
@@ -353,7 +354,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script type="text/javascript" ${nonce_attribute(request)} >
     (function () {
 
       function DownloadResultsViewModel (params, element) {
@@ -778,7 +779,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script type="text/javascript"  ${nonce_attribute(request)} >
     (function () {
 
       function AceKeyboardShortcutsViewModel () {
diff --git a/desktop/core/src/desktop/templates/config_ko_components.mako b/desktop/core/src/desktop/templates/config_ko_components.mako
index 3180a35580e..a9f3c7837db 100644
--- a/desktop/core/src/desktop/templates/config_ko_components.mako
+++ b/desktop/core/src/desktop/templates/config_ko_components.mako
@@ -24,6 +24,7 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
+from desktop.lib.django_util import nonce_attribute
 %>
 
 <%def name="config()">
@@ -124,7 +125,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script ${nonce_attribute(request)} type="text/javascript">
     (function () {
       function MultiGroupAlternative(alt, params, initiallyChecked) {
         var self = this;
@@ -215,7 +216,7 @@ else:
     })();
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)} type="text/javascript">
     (function () {
 
       function PropertySelectorViewModel(params) {
@@ -297,7 +298,7 @@ else:
     })();
   </script>
 
-  <script type="text/html" id="property">
+  <script  ${nonce_attribute(request)} type="text/html" id="property">
     <div class="config-property" data-bind="visibleOnHover: { selector: '.hover-actions' }">
       <label class="config-label" data-bind="click: function(data, event){ $(event.target).siblings('.config-controls').find('.config-property-add-value a').click(); }">
         <!-- ko text: label --><!-- /ko --><!-- ko if: typeof helpText !== 'undefined' --><div class="property-help" data-bind="tooltip: { title: helpText(), placement: 'bottom' }"><i class="fa fa-question-circle-o"></i></div><!-- /ko -->
@@ -365,7 +366,7 @@ else:
     <input type="text" class="input-small" data-bind="numericTextInput: { value: value, precision: 0, allowEmpty: true }" /> <select class="input-mini" data-bind="options: units, value: selectedUnit"></select>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)}  type="text/javascript">
     (function () {
       var JVM_MEM_PATTERN = /([0-9]+)([MG])$/;
       var UNITS = {'MB': 'M', 'GB': 'G'};
@@ -427,7 +428,7 @@ else:
     <div class="clearfix"></div>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)} type="text/javascript">
     (function () {
 
       function KeyValueListInputViewModel(params) {
@@ -530,7 +531,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)} type="text/javascript">
     (function () {
 
       function NameValueListInputViewModel(params) {
@@ -595,7 +596,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)} type="text/javascript">
     (function () {
 
       function FunctionListInputViewModel(params) {
@@ -649,7 +650,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)}  type="text/javascript">
     (function () {
 
       var identifyType = function (path) {
@@ -729,7 +730,7 @@ else:
     </div>
   </script>
 
-  <script type="text/javascript">
+  <script  ${nonce_attribute(request)} type="text/javascript">
     (function () {
       function CsvListInputViewModel(params) {
         this.valueObservable = params.value;
diff --git a/desktop/core/src/desktop/templates/hue.mako b/desktop/core/src/desktop/templates/hue.mako
index 50dee07a29c..891b8b33457 100644
--- a/desktop/core/src/desktop/templates/hue.mako
+++ b/desktop/core/src/desktop/templates/hue.mako
@@ -24,6 +24,7 @@
   from desktop.models import hue_version
   from desktop.views import _ko, commonshare, login_modal
   from desktop.webpack_utils import get_hue_bundles
+  from desktop.lib.django_util import nonce_attribute
 
   from webpack_loader.templatetags.webpack_loader import render_bundle
 
@@ -43,9 +44,10 @@
 
   % if conf.COLLECT_USAGE.get():
     <!-- Google tag (gtag.js) -->
-    <script async src="https://www.googletagmanager.com/gtag/js?id=${conf.GTAG_ID.get()}"></script>
-    <script>
+    <script ${nonce_attribute(request)} async src="https://www.googletagmanager.com/gtag/js?id=${conf.GTAG_ID.get()}"></script>
+    <script ${nonce_attribute(request)} >
       window.dataLayer = window.dataLayer || [];
+      window.nonce="${request.csp_nonce}";
       function gtag(){dataLayer.push(arguments);}
       gtag('js', new Date());
 
@@ -93,10 +95,10 @@
   <%
     global_constants_url = '/desktop/globalJsConstants.js?v=' + hue_version()
   %>
-  <script src="${global_constants_url}"></script>
+  <script ${nonce_attribute(request)}   src="${global_constants_url}"></script>
 
   % if not conf.DEV.get():
-  <script src="${ static('desktop/js/hue.errorcatcher.js') }"></script>
+  <script ${nonce_attribute(request)}   src="${ static('desktop/js/hue.errorcatcher.js') }"></script>
   % endif
 </head>
 
@@ -110,8 +112,8 @@
   </ul>
 
   <!-- UserVoice JavaScript SDK -->
-  <script>(function(){var uv=document.createElement('script');uv.type='text/javascript';uv.async=true;uv.src='//widget.uservoice.com/8YpsDfIl1Y2sNdONoLXhrg.js';var s=document.getElementsByTagName('script')[0];s.parentNode.insertBefore(uv,s)})()</script>
-  <script>
+  <script ${nonce_attribute(request)}  >(function(){var uv=document.createElement('script');uv.type='text/javascript';uv.async=true;uv.src='//widget.uservoice.com/8YpsDfIl1Y2sNdONoLXhrg.js';var s=document.getElementsByTagName('script')[0];s.parentNode.insertBefore(uv,s)})()</script>
+  <script ${nonce_attribute(request)}  >
   UserVoice = window.UserVoice || [];
   function showClassicWidget() {
     UserVoice.push(['showLightbox', 'classic_widget', {
@@ -295,24 +297,25 @@ ${ hueIcons.symbols() }
 </div>
 ${ commonshare() | n,unicode }
 
-% for bundle in get_hue_bundles('hue'):
-  ${ render_bundle(bundle) | n,unicode }
+% for bundle in get_hue_bundles('login' if section == 'login' else 'hue', 'LOGIN' if section == 'login' else 'DEFAULT'):
+  <% text = render_bundle(bundle, config='LOGIN' if section == 'login' else 'DEFAULT').replace('<script ', '<script' + nonce_attribute(request) + ' ') %>
+  ${ text | n}
 % endfor
 
-<script src="${ static('desktop/js/polyfills.js') }"></script>
-<script src="${ static('desktop/ext/js/tether.js') }"></script>
-<script src="${ static('desktop/ext/js/moment-with-locales.min.js') }"></script>
-<script src="${ static('desktop/ext/js/moment-timezone-with-data.min.js') }"></script>
-<script src="${ static('desktop/ext/js/tzdetect.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/js/polyfills.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/tether.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/moment-with-locales.min.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/moment-timezone-with-data.min.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/tzdetect.js') }"></script>
 
-<script src="${ static('desktop/ext/js/bootstrap-fileupload.js') }"></script>
-<script src="${ static('desktop/js/bootstrap-tooltip.js') }"></script>
-<script src="${ static('desktop/js/bootstrap-typeahead-touchscreen.js') }"></script>
-<script src="${ static('desktop/ext/js/bootstrap-better-typeahead.min.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/bootstrap-fileupload.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/js/bootstrap-tooltip.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/js/bootstrap-typeahead-touchscreen.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/ext/js/bootstrap-better-typeahead.min.js') }"></script>
 
-<script src="${ static('desktop/js/share2.vm.js') }"></script>
+<script ${nonce_attribute(request)}  src="${ static('desktop/js/share2.vm.js') }"></script>
 
-<script>
+<script ${nonce_attribute(request)}  >
   var shareViewModel = initSharing("#documentShareModal");
 </script>
 
@@ -334,7 +337,7 @@ ${ smart_unicode(login_modal(request).content) | n,unicode }
 
 <iframe id="zoomDetectFrame" style="width: 250px; display: none" ></iframe>
 
-${ commonHeaderFooterComponents.footer(messages) }
+${ commonHeaderFooterComponents.footer(messages, nonce) }
 
 ## This includes common knockout templates that are shared with the Job Browser page and the mini job browser panel
 ## available in the upper right corner throughout Hue
diff --git a/desktop/core/src/desktop/templates/hue_ace_autocompleter.mako b/desktop/core/src/desktop/templates/hue_ace_autocompleter.mako
index e958e2586b8..aa0f94d4089 100644
--- a/desktop/core/src/desktop/templates/hue_ace_autocompleter.mako
+++ b/desktop/core/src/desktop/templates/hue_ace_autocompleter.mako
@@ -23,6 +23,7 @@ if sys.version_info[0] > 2:
   from django.utils.translation import gettext as _
 else:
   from django.utils.translation import ugettext as _
+from desktop.lib.django_util import nonce_attribute
 %>
 
 <%def name="hueAceAutocompleter()">
@@ -356,7 +357,7 @@ else:
   </script>
 
 
-  <script type="text/javascript">
+  <script type="text/javascript" ${nonce_attribute(request)}>
     (function () {
 
       var aceUtil = ace.require('ace/autocomplete/util');
@@ -722,7 +723,7 @@ else:
     <!-- /ko -->
   </script>
 
-  <script type="text/javascript">
+  <script type="text/javascript" ${nonce_attribute(request)}>
     (function () {
 
       var COMMENT_LOAD_DELAY = 1500;
diff --git a/desktop/core/src/desktop/templates/login.mako b/desktop/core/src/desktop/templates/login.mako
index d771099d2f8..7b62f6dd1f4 100644
--- a/desktop/core/src/desktop/templates/login.mako
+++ b/desktop/core/src/desktop/templates/login.mako
@@ -21,11 +21,11 @@
 
   from desktop.conf import CUSTOM, ENABLE_ORGANIZATIONS
   from desktop.views import commonheader, commonfooter
-
   if sys.version_info[0] > 2:
     from django.utils.translation import gettext as _
   else:
     from django.utils.translation import ugettext as _
+  from desktop.lib.django_util import nonce_attribute
 %>
 
 <%namespace name="hueIcons" file="/hue_icons.mako" />
@@ -161,7 +161,7 @@ ${ commonheader(_("Welcome to Hue"), "login", user, request, "50px", True, True)
    % endif
 </div>
 
-<script>
+<script ${nonce_attribute(request)}>
   $(document).ready(function () {
     $("form").on("submit", function () {
       window.setTimeout(function () {
@@ -195,4 +195,4 @@ ${ commonheader(_("Welcome to Hue"), "login", user, request, "50px", True, True)
   });
 </script>
 
-${ commonfooter(None, messages) | n,unicode }
+${ commonfooter(request, messages, nonce ) | n,unicode }
diff --git a/desktop/core/src/desktop/templates/login_modal.mako b/desktop/core/src/desktop/templates/login_modal.mako
index 73778d86896..1187e296e9b 100644
--- a/desktop/core/src/desktop/templates/login_modal.mako
+++ b/desktop/core/src/desktop/templates/login_modal.mako
@@ -22,7 +22,7 @@
     from django.utils.translation import gettext as _
   else:
     from django.utils.translation import ugettext as _
-
+  from desktop.lib.django_util import nonce_attribute
   from useradmin.hue_password_policy import is_password_policy_enabled, get_password_hint
 %>
 
@@ -49,7 +49,7 @@
   </div>
 </div>
 
-<script>
+<script ${nonce_attribute(request)} >
   $(document).ready(function () {
     $('.reload').on('click', function () {
       location.reload();
diff --git a/desktop/core/src/desktop/views.py b/desktop/core/src/desktop/views.py
index 72c4cef8401..9fb4120c09c 100644
--- a/desktop/core/src/desktop/views.py
+++ b/desktop/core/src/desktop/views.py
@@ -68,6 +68,7 @@
 from libsaml.conf import REQUIRED_GROUPS, REQUIRED_GROUPS_ATTRIBUTE
 from useradmin.models import get_profile
 from useradmin.models import User
+from django.utils.html import format_html
 
 if sys.version_info[0] > 2:
   from io import StringIO as string_io
@@ -654,6 +655,7 @@ def is_idle(request):
 def commonfooter_m(request, messages=None):
   return commonfooter(request, messages, True)
 
+
 def commonfooter(request, messages=None, is_mobile=False):
   """
   Returns the rendered common footer
@@ -666,7 +668,6 @@ def commonfooter(request, messages=None, is_mobile=False):
   template = 'common_footer.mako'
   if is_mobile:
     template = 'common_footer_m.mako'
-
   return django_mako.render_to_string(template, {
     'request': request,
     'messages': messages,
diff --git a/desktop/libs/notebook/src/notebook/templates/editor2.mako b/desktop/libs/notebook/src/notebook/templates/editor2.mako
index 18cfa927b59..9741e6c0e52 100644
--- a/desktop/libs/notebook/src/notebook/templates/editor2.mako
+++ b/desktop/libs/notebook/src/notebook/templates/editor2.mako
@@ -25,6 +25,7 @@
     from django.utils.translation import gettext as _
   else:
     from django.utils.translation import ugettext as _
+  from desktop.lib.django_util import nonce_attribute
 %>
 
 <%namespace name="configKoComponents" file="/config_ko_components.mako" />
@@ -1069,7 +1070,7 @@ There is no bridge to KO for components using this integration. Example using in
   </div>
 </div>
 
-<script type="text/javascript">
+<script ${nonce_attribute(request)} type="text/javascript">
   window.EDITOR_BINDABLE_ELEMENT = '#editorComponents';
 
   window.EDITOR_SUFFIX = 'editor';
diff --git a/desktop/libs/notebook/src/notebook/templates/editor_components.mako b/desktop/libs/notebook/src/notebook/templates/editor_components.mako
index 24ad6624757..832fc33f7a7 100644
--- a/desktop/libs/notebook/src/notebook/templates/editor_components.mako
+++ b/desktop/libs/notebook/src/notebook/templates/editor_components.mako
@@ -24,7 +24,7 @@ from desktop.auth.backend import is_admin
 from desktop.lib.i18n import smart_unicode
 from desktop.views import _ko, antixss
 from desktop.webpack_utils import get_hue_bundles
-
+from desktop.lib.django_util import nonce_attribute
 from metadata.conf import has_optimizer, OPTIMIZER
 
 from notebook.conf import ENABLE_QUERY_BUILDER, ENABLE_QUERY_SCHEDULING, ENABLE_BATCH_EXECUTE, ENABLE_EXTERNAL_STATEMENT, ENABLE_PRESENTATION
@@ -2054,7 +2054,7 @@ else:
 
 <%def name="commonJS(is_embeddable=False, bindableElement='editorComponents', suffix='')">
 
-<script type="text/javascript">
+<script ${nonce_attribute(request)} type="text/javascript">
   window.EDITOR_BINDABLE_ELEMENT = '#${ bindableElement }';
 
   window.EDITOR_SUFFIX = '${ suffix }';