Question: why does the nonce staticmethod add angle brackets around the nonce value?

[jrobbins-LiveData]

secure/secure/headers.py

Line 452 in 04dd035

value = "'nonce-<{}>'".format(value)

The examples of adding a nonce to CSP that I've seen in, e.g., https://csp.withgoogle.com/docs/strict-csp.html#example and https://content-security-policy.com/nonce/ show 'nonce-rAnd0m'.

The CSP3 spec specifies the nonce production as:

; Nonces: 'nonce-[nonce goes here]'
nonce-source  = "'nonce-" [base64-value](https://www.w3.org/TR/CSP3/#grammardef-base64-value) "'"
base64-value  = 1*( [ALPHA](https://tools.ietf.org/html/rfc5234#appendix-B.1) / [DIGIT](https://tools.ietf.org/html/rfc5234#appendix-B.1) / "+" / "/" / "-" / "_" )*2( "=" )

Are the characters < and > even allowed?

[cak]

Thank you @jrobbins-LiveData!