Source list values

A script-src source list is a space-separated set of source expressions. This page is the reference for every value the directive accepts.

Keyword sources

Keywords are wrapped in single quotes. The quotes are part of the syntax, not optional.

Value	Meaning
'self'	Scripts from the page's own origin (same scheme, host, and port).
'none'	Block all scripts. An empty list behaves the same way.
'unsafe-inline'	Allow inline scripts and event handlers. See unsafe keywords.
'unsafe-eval'	Allow eval and similar string-to-code APIs.
'wasm-unsafe-eval'	Allow WebAssembly compilation without allowing JS eval.
'unsafe-hashes'	Allow inline event handlers whose code matches a listed hash.
'strict-dynamic'	Propagate trust from a nonce or hash to scripts it loads. See strict-dynamic.
'report-sample'	Include a short sample of the offending code in violation reports.

Host sources

A host source matches by scheme, host, port, and optionally path.

script-src example.com
script-src https://example.com
script-src https://example.com:443
script-src https://cdn.example.com/js/

• *.example.com matches any subdomain, but not example.com itself.
• A bare host like example.com matches both http: and https: on the default ports.
• A trailing path restricts to that path prefix. https://cdn.example.com/js/ allows /js/app.js but not /other/app.js.

Avoid a bare *. It allows scripts from any host and defeats the point of the directive.

Scheme sources

A scheme source allows every origin using that scheme:

script-src https:

https: allows scripts from any host over HTTPS. Never use data: in script-src. A data: source lets an attacker inline a script as a URL, which reintroduces the XSS you are trying to block.

Nonces

A nonce allows one specific inline script per response:

script-src 'nonce-r4nd0m'

<script nonce="r4nd0m">/* runs */</script>

The value must be fresh, random, and unguessable on every response. Full details are on the nonces page. The value must be generated on the server, fresh on every response.

Hashes

A hash allows one inline script whose contents match exactly:

script-src 'sha256-BpfBOAGst…'

Supported algorithms are sha256, sha384, and sha512. See hashes for how the digest is computed.