Is there a way to send a header with a random number in it, e.g. "add_header nonce $rand".

I'd also need to store the random number on disk and associate it with the connection serial number.

The nonce header would be used to create a unique server-side file directory for each connection. The unique directory would use used with CSP's (Content Security Policy) "script-src" directive.

I don't want to use cookies or other client-side methods.

Thanks

With the addon headers-more and Lua you can do this.