CSP Hash
A CSP hash is a hash of inline script/style content attached to the CSP header, allowing only inline elements whose content matches the hash.
Purpose
To statically allow specific inline scripts without loosening CSP, suited to inline scripts with fixed content.
Mechanism
Compute the SHA-256/384/512 hash of the inline script content; the CSP header includes script-src 'sha256-abc...', and only <script> whose content hash matches is allowed. Changing the content requires updating the hash.
Use cases
- Static inline script allowlisting
- CSP hardening
- XSS defense