public String getNonce() {
        if (nonce == null) {
            // If it's a POST, we already generated a nonce in the initial request
            // -> try to reuse and validate it
            if (context.isPostback() || context.getPartialViewContext().isAjaxRequest()) {
                Map<String, Object> viewMap = context.getViewRoot().getViewMap(false);

                String nonceRequest = context.getExternalContext().getRequestParameterMap().get(Constants.RequestParams.NONCE_PARAM);
                String nonceViewState = viewMap == null ? null : (String) viewMap.get(Constants.RequestParams.NONCE_PARAM);

                // Validate if nonceRequest matches nonceViewState
                // There are some cases when the nonceViewState can be null, "" must not happen actually
                // 1) if the request is a GET / initial request
                //      this is handled by the outer IF
                // 2) if the viewMap is null
                //      this is most likely a case when stateless views are used
                // 3) if the nonceViewState is null
                //      this can happen when a navigation or forward is done inside the current request
                if (nonceViewState != null) {
                    // normalize both to make it comparable
                    nonceRequest = Objects.toString(nonceRequest, Constants.EMPTY_STRING);
                    nonceViewState = Objects.toString(nonceViewState, Constants.EMPTY_STRING);

                    if (!Objects.equals(nonceRequest, nonceViewState)) {
                        throw new CspException("CSP nonce mismatch");
                    }
                }

                // always prefer nonceViewState over nonceRequest
                nonce = LangUtils.isNotBlank(nonceViewState) ? nonceViewState : nonceRequest;

                // in case of a forward, we might create a new nonce here
                // but it also means that the request had NO CSP request param... is this valid?
                if (LangUtils.isBlank(nonce) && isForward(context)) {
                    nonce = generateNonce();
                }

                validate(nonce);
            }
            // otherwise create a new nonce
            else {
                nonce = generateNonce();
                if (!context.getViewRoot().isTransient()) {
                    context.getViewRoot().getViewMap(true).put(Constants.RequestParams.NONCE_PARAM, nonce);
                }
            }
        }

        return nonce;
    }
Retrieves or generates a nonce (number used once) for Content Security Policy (CSP).

@return the nonce as a Base64 encoded string
@throws CspException if there's a nonce mismatch or validation fails
primefaces/src/main/java/org/primefaces/csp/CspState.java