I am trying to secure my JavaScript code with a nonce by using a line like this in .htaccess apache:

default-src 'self' 'nonce-%{base64:%{reqenv:UNIQUE_ID}}';

and then on the page

<script type="text/javascript" nonce="'.$_SERVER ['UNIQUE_ID'].'">' ... code ... '</script>

The trouble is I get nonces should only use the base64 charset in

https://cspscanner.com/

Probably expects text there, just checking.

Please help, thank you!