v141 · security
Extend CSP script-src (aka script-src-v2)
Introduces a new keywords to the script-src Content Security Policy (CSP) directive. This adds two new hash based allowlisting mechanisms: script sources based on hashes of URLs and contents of eval() and eval() like functions. We loosely refer to this as script-src-v2, although it is backwards compatible with the existing script-src, and uses the same direc
concepts
-
CSP script-src v2
script-src-v2 brings finer-grained source matching (URL patterns, integrity assertions, signature checks) on top of the existing CSP grammar.
-
URL Hashes
Pin a specific external script by hashing its URL (not its contents). Type a URL, see the
'url-sha256-…'keyword you'd add to your CSP — and a side-by-side diff against the broad host-source it replaces. -
Eval Hashes
The migration path off
'unsafe-eval'. Per-string allowlisting via'eval-sha256-…'— type an eval string, get the keyword, drop the broad escape hatch. -
CSP Policy Builder
Two-column policy editor: left column assembles a script-src-v2 header by toggling inline scripts, eval, URL hashes, and external origins; right column shows the live header string and tests it against sample script tags with pass/fail results.
why it shipped
Allowlist script-src URLs with their hashes with a new keyword called url-hashes: Sites that want to allowlist scripts for use with script-src currently have 2 options: allowlist script contents through subresource integrity, which is not practical for scripts that change often (e.g. analytics), or use host-source to allowlist entire hostnames (thus allowlisting more than may be necessary). This proposal permits allowlisting full URLs, which permits precise allowlist targeting while still allowing content to change as needed. Using hashes over raw URLs in the policy allows for a more succinct