What does the script-src directive do?

script-src controls which sources the browser is allowed to load and execute JavaScript from. It overrides default-src for scripts.

Should I use a nonce or a hash for inline scripts?

Use a nonce for dynamic pages where you can set a fresh random value per response. Use a hash for static inline scripts whose contents never change.

Content-Security-Policy

script-src

The script-src directive controls which sources a browser may load and execute JavaScript from. It is the core CSP directive for stopping cross-site scripting: once it is set, an injected script will not run unless you have explicitly allowed it.

Read the documentation Hash an inline script →

response header

Content-Security-Policy:
  script-src 'self' https://cdn.example.com 'nonce-r4nd0m';

Allows same-origin scripts, one trusted CDN, and a single nonced inline script. Everything else is blocked.

Source values

Full reference →

Value	Meaning
'self'	Scripts from the page's own origin.
'none'	Block every script source.
https://host	An explicit host you choose to trust.
'nonce-…'	One inline script tagged with a matching nonce.
'sha256-…'	One inline script whose contents match this hash.
'strict-dynamic'	Trust scripts loaded by already-trusted scripts.

Documentation

Getting started

Allowing inline scripts

Reference

Guides

Checking a whole policy

This site documents one directive. To evaluate an entire Content-Security-Policy, including every directive, its fallbacks, and known bypasses, run it through CentralCSP's CSP evaluator.