demo · v141

CSP Policy Builder

Build a Content Security Policy header interactively. Toggle inline scripts, eval, external URLs, and trusted types — then switch between the old single script-src and the new script-src-elem + script-src-attr split. Paste a tag or URL into the test field to check if the policy would allow it.

probing script-src-v2 support…

policy format

inline scripts
script execution
origins
trusted types
external script URLs

    Each URL is hashed with SHA-384 and expressed as 'url-hashes-sha384-…' in script-src-v2, or as a host allowlist entry in legacy mode.

    generated Content-Security-Policy header
    (building…)

    Test: would this be allowed?

    Paste a URL or inline script body and click Evaluate.

    Why script-src-v2 matters

    The legacy script-src applies to both <script src="…"> elements and inline event handlers (onclick="…", href="javascript:…"). These have very different risk profiles. script-src-elem controls <script> elements only, while script-src-attr controls attribute-based script — so you can allow external scripts while fully blocking attribute injection, without needing unsafe-inline on either.

    comparison

    # Old: script-src covers both elements and attributes
Content-Security-Policy:
  script-src 'self' 'strict-dynamic' 'wasm-unsafe-eval'
    'sha256-abc123=';

# New: fine-grained split (script-src-v2)
Content-Security-Policy:
  script-src-elem 'self' 'strict-dynamic' 'wasm-unsafe-eval'
    'url-hashes-sha384-xyz=';  /* pin script elements by URL hash */
  script-src-attr 'none';      /* block ALL attribute-based scripts */

    see also