symfony/var-dumper · error · LogicException

The nonce closure passed to

Error message

The nonce closure passed to "%s::setNonce()" must return a string or null, "%s" returned.

What it means

HtmlDumper::setNonce() accepts a string, null, or a Closure returning string|null. resolveNonce() invokes the closure and validates the return; if it returns a non-string non-null value (int, bool, object, etc.), a LogicException is thrown naming the expected types.

Solutions

1. Ensure the closure returns a string or null; cast with (string) or return null when no nonce
2. If using a bool/false sentinel, change it to return null
3. Fix the nonce provider (e.g. cast $request->attributes->get('_csp_nonce') to string) feeding the closure

Example fix

// before
$dumper->setNonce(fn () => $nonceId);
// after
$dumper->setNonce(fn () => $nonceId !== null ? (string) $nonceId : null);

$resolved = $nonce instanceof \Closure ? $nonce() : $nonce;
if ($resolved !== null && !is_string($resolved)) {
    throw new \TypeError('Nonce must resolve to string or null, got '.get_debug_type($resolved));
}

function isValidNonce(mixed $resolved): bool {
    return $resolved === null || is_string($resolved);
}

try {
    $dumper->setNonce($nonceProvider);
} catch (\LogicException $e) {
    if (str_contains($e->getMessage(), 'setNonce()')) {
        $dumper->setNonce(null); // fall back to no CSP nonce
    } else {
        throw $e;
    }
}

When it happens

Trigger: `$dumper->setNonce(fn () => 12345)` or a closure returning an int, bool, Stringable object, or array instead of string or null.

Common situations: CSP nonce helpers that return integer IDs or objects; closures reading config values that are not cast to string; returning false as a 'missing' sentinel instead of null.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• " " object holds non-iterable type " ".

AI-assisted analysis of symfony/var-dumper@e9d9cf5dcd (2026-09-14). Data as JSON: /api/errors/5ff9d4cdddb7feed. Report an issue: GitHub.

Appendix: source

Thrown at Dumper/HtmlDumper.php:178

        if (null !== $styleNonce) {
            $replacements['<style>'] = '<style nonce="'.esc($styleNonce).'">';
        }

        if (!$replacements) {
            return $html;
        }

        return str_replace(array_keys($replacements), array_values($replacements), $html);
    }

    private function resolveNonce(string|\Closure|null $nonce): ?string
    {
        if (!$nonce instanceof \Closure) {
            return $nonce;
        }

        if (!\is_string(($value = $nonce()) ?? '')) {
            throw new \LogicException(\sprintf('The nonce closure passed to "%s::setNonce()" must return a string or null, "%s" returned.', self::class, get_debug_type($value)));
        }

        return $value;
    }

    public function dump(Data $data, $output = null, array $extraDisplayOptions = []): ?string
    {
        $this->extraDisplayOptions = $extraDisplayOptions;
        $result = parent::dump($data, $output);
        $this->dumpId = 'sf-dump-'.mt_rand();

        return $result;
    }

    /**
     * Dumps the HTML header.
     */
    protected function getDumpHeader(): string

View on GitHub (pinned to e9d9cf5dcd)