diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs
index 8715dd2f29..260f28f812 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs
@@ -49,6 +49,9 @@ public class AbpTagHelperScriptService : AbpTagHelperResourceService
         var deferText = (defer || Options.DeferScriptsByDefault || Options.DeferScripts.Any(x => file.StartsWith(x, StringComparison.OrdinalIgnoreCase)))
                 ? "defer"
                 : string.Empty;
-        output.Content.AppendHtml($"<script {deferText} src=\"{viewContext.GetUrlHelper().Content(file.EnsureStartsWith('~'))}\"></script>{Environment.NewLine}");
+        var nonceText = (viewContext.HttpContext.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) && nonce is string nonceString && !string.IsNullOrEmpty(nonceString))
+            ? $"nonce=\"{nonceString}\""
+            : string.Empty;
+        output.Content.AppendHtml($"<script {deferText} {nonceText} src=\"{viewContext.GetUrlHelper().Content(file.EnsureStartsWith('~'))}\"></script>{Environment.NewLine}");
     }
 }
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs
index dff987b6b3..134889324e 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs
@@ -4,4 +4,5 @@ public static class AbpAspNetCoreConsts
 {
     public const string DefaultApiPrefix = "api";
     public const string DefaultIntegrationServiceApiPrefix = "integration-api";
+    public const string ScriptNonceKey = "ScriptNonce";
 }
\ No newline at end of file
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
index 29e05b9bdc..c24d412fd0 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
@@ -27,13 +28,31 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
 
         /*The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object>. SAMEORIGIN makes it being displayed in a frame on the same origin as the page itself. The spec leaves it up to browser vendors to decide whether this option applies to the top level, the parent, or the whole chain*/
         AddHeader(context, "X-Frame-Options", "SAMEORIGIN");
+        
+        var contentSecurityPolicyValueDictionary = Options.Value.ContentSecurityPolicyValueDictionary.ToDictionary(x=>x.Key, x=>x.Value);
 
         if (Options.Value.UseContentSecurityPolicyHeader)
         {
+            if (Options.Value.UseContentSecurityPolicyNonce)
+            {
+                if (!context.Items.ContainsKey(AbpAspNetCoreConsts.ScriptNonceKey))
+                {
+                    var randomValue = Guid.NewGuid().ToString("N");
+                    context.Items.Add(AbpAspNetCoreConsts.ScriptNonceKey, randomValue);
+                    if (contentSecurityPolicyValueDictionary.TryGetValue("script-src", out var scriptSrc))
+                    {
+                        contentSecurityPolicyValueDictionary["script-src"] = scriptSrc.Append($"'nonce-{randomValue}'");
+                    }
+                    else
+                    {
+                        contentSecurityPolicyValueDictionary.Add("script-src", new[] { $"'nonce-{randomValue}'" });
+                    }
+                }
+            }
             AddHeader(context, "Content-Security-Policy",
-                Options.Value.ContentSecurityPolicyValue.IsNullOrEmpty()
-                    ? "object-src 'none'; form-action 'self'; frame-ancestors 'none'"
-                    : Options.Value.ContentSecurityPolicyValue);
+                Options.Value.ContentSecurityPolicyValueDictionary.Any()
+                    ? string.Join("; ", contentSecurityPolicyValueDictionary.Select(x => $"{x.Key} {string.Join(" ", x.Value)}"))
+                    : "object-src 'none'; form-action 'self'; frame-ancestors 'none'");
         }
         
         foreach (var (key, value) in Options.Value.Headers)
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
index 93b0dc9236..31bb7b28a7 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
@@ -5,13 +5,16 @@ namespace Volo.Abp.AspNetCore.Security;
 public class AbpSecurityHeadersOptions
 {
     public bool UseContentSecurityPolicyHeader { get; set; }
+    
+    public bool UseContentSecurityPolicyNonce { get; set; }
 
-    public string ContentSecurityPolicyValue { get; set; }
+    public Dictionary<string,IEnumerable<string>> ContentSecurityPolicyValueDictionary { get; }
 
     public Dictionary<string, string> Headers { get; }
 
     public AbpSecurityHeadersOptions()
     {
         Headers = new Dictionary<string, string>();
+        ContentSecurityPolicyValueDictionary = new Dictionary<string, IEnumerable<string>>();
     }
 }