demo · v133

CSP Hash Reporting

Paste a script body. Compute its real SubtleCrypto hash in your browser, then see the shape of the CSP violation report Chrome 133+ now emits — including the candidate hashes you'd add to script-src to allow it.

script body (will be hashed exactly as-is, including whitespace)

click "compute" to populate

SecurityPolicyViolation report (Chrome 133+ shape)

{}

the code

// Server response:
Content-Security-Policy: script-src 'self'; report-to csp
Reporting-Endpoints: csp="/csp-collector"

// On a violation Chrome 133+ now also emits hash candidates
// inside the report body, so you can incrementally add them:
// script-src 'self' 'sha256-2Ahw...' 'sha256-...'

// Client-side feature-detect via SecurityPolicyViolationEvent:
addEventListener("securitypolicyviolation", (e) => console.log(e));

see also