Documentation
A reference for the script-src Content-Security-Policy directive: what each value means, how to allow inline scripts safely, and how to roll out a policy in production.
Getting started
Allowing inline scripts
- Nonces How CSP script-src nonces work, how to generate them safely, and the mistakes that silently disable them.
- Hashes How CSP script-src hashes allowlist inline scripts by their exact contents, including how the digest is computed.
- strict-dynamic How the strict-dynamic keyword propagates trust from a nonce or hash to dynamically loaded scripts, and the recommended strict CSP pattern.
Reference
- unsafe-inline, unsafe-eval, and friends What the unsafe-inline, unsafe-eval, unsafe-hashes, and wasm-unsafe-eval keywords allow in script-src, and when each is justified.
- script-src-elem and script-src-attr How the CSP Level 3 directives script-src-elem and script-src-attr split script control, and how they fall back to script-src.
Guides
- Troubleshooting blocked scripts The console errors a script-src violation produces and how to fix each one, from blocked inline scripts to eval and strict-dynamic issues.
- Violation reporting How to collect script-src violations in production with Reporting-Endpoints and report-to, plus the older report-uri directive.