demo · v133

Hash harvester & allowlist builder

Paste an inline script snippet. We compute the three CSP hash candidates that the Chrome 133+ reporter would surface in a violation, and assemble a copy-pasteable Content-Security-Policy header you can slot into your migration.

This page hashes locally. To capture real-world reports, deploy Content-Security-Policy-Report-Only: script-src 'self'; report-to csp; require-trusted-types-for 'script' and ingest violation reports for the hash candidates Chrome attaches.

script body (no <script> wrapper)

sha256-…— sha384-…— sha512-…—

generated CSP policy

Content-Security-Policy: script-src 'self'; report-to csp

how this fits the rollout

Chrome 133 attaches the hash of every inline script that violates the active policy to the SecurityPolicyViolationEvent and the corresponding report payload. The intended workflow is:

  1. Ship a Content-Security-Policy-Report-Only header that disallows inline scripts.
  2. Collect reports for a sampling window. Each report carries the SHA hash of the inline script content the browser saw.
  3. Diff against the set of scripts you actually wanted — the deltas are unauthorised inclusions (third-party tags, marketing pixels, supply-chain insertions).
  4. Promote the resulting 'sha256-…' allowlist into your enforcing CSP.

This page is the bridge step: take a known-good inline script, compute its hash, and emit a header line.

see also