diff --git a/js/documents.js b/js/documents.js
index 6a8a010ef1..3311baa7c1 100644
--- a/js/documents.js
+++ b/js/documents.js
@@ -413,7 +413,7 @@ var documentsMain = {
 			  '<input name="access_token" value="' + access_token + '" type="hidden"/></form>';
 
 			// iframe that contains the Collabora Online Viewer
-			var frame = '<iframe id="loleafletframe_viewer" name= "loleafletframe_viewer" style="width:100%;height:100%;position:absolute;"/>';
+			var frame = '<iframe id="loleafletframe_viewer" name="loleafletframe_viewer" nonce="' + btoa(OC.requestToken) + '" style="width:100%;height:100%;position:absolute;"/>';
 
 			$('#revViewer').append(form);
 			$('#revViewer').append(frame);
diff --git a/js/viewer/viewer.js b/js/viewer/viewer.js
index 9cc0afedf1..b3e1e71335 100644
--- a/js/viewer/viewer.js
+++ b/js/viewer/viewer.js
@@ -129,7 +129,7 @@ var odfViewer = {
 
 		OC.addStyle('richdocuments', 'mobile');
 
-		var $iframe = $('<iframe id="richdocumentsframe" scrolling="no" allowfullscreen src="'+viewer+'" />');
+		var $iframe = $('<iframe id="richdocumentsframe" nonce="' + btoa(OC.requestToken) + '" scrolling="no" allowfullscreen src="'+viewer+'" />');
 		$.get(OC.generateUrl('/apps/richdocuments/settings/check'), function() {
 			$iframe.src = viewer;
 		}) .fail(function() {