Content Security Policy (CSP) Reference
Reference 为 CSP directives, 源, 和 nonce/hash-based 脚本 allowlisting.
Directives and Sources
CSP directives control resource loading: default-src (fallback), script-src, style-src, img-src, connect-src, font-src, frame-src, object-src, media-src. Source values include * (any), none, self (same origin), data:, blob:, specific URLs, nonces (nonce-xxx), and hashes (sha256-xxx). The report-uri directive sends violation reports. CSP prevents XSS by restricting script sources. A strict policy uses nonces or hashes instead of unsafe-inline.
- script-src
- Script sources
- nonce
- Per-request random
- report-uri
- Violation reports
most criticalnonce-abc123monitoringBest Practices
Start with Content-Security-Policy-Report-Only to monitor violations before enforcement. Use nonces for scripts that cannot be externalized. Avoid unsafe-inline and unsafe-eval which weaken protection. Set base-uri to prevent base tag hijacking. Use frame-ancestors to prevent clickjacking (replaces X-Frame-Options). Strict CSP: default-src none; script-src nonce; style-src nonce; connect-src self. CSP Level 3 adds strict-dynamic for trust propagation.
- Report-Only
- Monitor before enforce
- strict-dynamic
- Trust propagation
- frame-ancestors
- Clickjacking prevention
no blockingCSP Level 3replaces XFO