According to docs: Set the ngCspNonce attribute on the root application element as . Use this approach if you have access to server-side templating that can add the nonce both to the header and the index.html when constructing the response. Provide the nonce using the CSP_NONCE injection token. Use this approach if you have access to the nonce at runtime and you want to be able to cache the index.html. However with new engine AngularNodeAppEngine i have no clue what should i do to achive this. Continue reading...