demo · v141

CSP script-src v2

Pin a script's URL by hash with the new url-hashes source. The simulator below computes the real SHA-256 of an absolute URL or inline string, builds the matching policy clause, and decides — client-side — whether the script load would be allowed.

script src (absolute URL — for url-hashes)

script body (for sha256 inline-hash)

Generated Content-Security-Policy

test src URL (paste a script URL to evaluate)

no decision yet.

the policy

Content-Security-Policy: script-src
  'url-hashes-sha256-aWQt…='     /* matches scripts loaded from this exact URL */
  'sha256-3jABC…='               /* matches inline / fetched body with this digest */
  'self';

the policy

see also