CSP Directive Reference

Quick reference for all CSP directives and source values.

Fetch Directives

Control which resources can be loaded.

Directive	Description	Example
`default-src`	Fallback for other fetch directives	`default-src 'self'`
`script-src`	Valid sources for JavaScript	`script-src 'self' https://cdn.com`
`style-src`	Valid sources for stylesheets	`style-src 'self' 'unsafe-inline'`
`img-src`	Valid sources for images	`img-src 'self' data: https:`
`font-src`	Valid sources for fonts	`font-src 'self' https://fonts.com`
`connect-src`	Valid URLs for fetch, XHR, WebSocket, EventSource	`connect-src 'self' wss://api.com`
`media-src`	Valid sources for `<audio>` and `<video>`	`media-src 'self'`
`object-src`	Valid sources for `<object>`, `<embed>`, `<applet>`	`object-src 'none'`
`frame-src`	Valid sources for `<frame>` and `<iframe>`	`frame-src https://youtube.com`
`child-src`	Valid sources for workers and frames	`child-src 'self' blob:`
`worker-src`	Valid sources for Worker, SharedWorker, ServiceWorker	`worker-src 'self' blob:`
`manifest-src`	Valid sources for web app manifests	`manifest-src 'self'`
`prefetch-src`	Valid sources for prefetch and prerender	`prefetch-src 'self'`

Document Directives

Control document properties.

Directive	Description	Example
`base-uri`	Valid URLs for `<base>` element	`base-uri 'self'`
`sandbox`	Enable sandbox for the page (like iframe sandbox)	`sandbox allow-scripts`

Control where users can navigate.

Directive	Description	Example
`form-action`	Valid URLs for form submissions	`form-action 'self'`
`frame-ancestors`	Valid parents that can embed this page	`frame-ancestors 'none'`
`navigate-to`	Valid URLs the document can navigate to	`navigate-to 'self'`

Reporting Directives

Configure violation reporting.

Directive	Description	Example
`report-uri`	URL to send violation reports (deprecated)	`report-uri https://ingest.headerhawk.com/csp/ID`
`report-to`	Reporting API endpoint group name	`report-to csp-endpoint`

Other Directives

Directive	Description	Example
`upgrade-insecure-requests`	Upgrade HTTP requests to HTTPS	`upgrade-insecure-requests`
`block-all-mixed-content`	Block all HTTP content on HTTPS pages	`block-all-mixed-content`
`require-trusted-types-for`	Require Trusted Types for scripts	`require-trusted-types-for 'script'`
`trusted-types`	Allow specific Trusted Types policies	`trusted-types default`

Source Values

Value	Description
`'self'`	Same origin as the document
`'none'`	No sources allowed
`'unsafe-inline'`	Allow inline scripts/styles
`'unsafe-eval'`	Allow `eval()`, `Function()`, etc.
`'unsafe-hashes'`	Allow inline event handlers
`'strict-dynamic'`	Trust scripts loaded by trusted scripts
`'report-sample'`	Include code sample in violation reports
`'nonce-{base64}'`	Allow inline scripts/styles with matching nonce
`'sha256-{hash}'`	Allow inline scripts/styles with matching hash
`'sha384-{hash}'`	Allow inline scripts/styles with matching hash
`'sha512-{hash}'`	Allow inline scripts/styles with matching hash
`https:`	Any HTTPS URL
`http:`	Any HTTP URL (not recommended)
`data:`	Data URIs
`blob:`	Blob URIs
`mediastream:`	MediaStream URIs
`filesystem:`	FileSystem URIs
`wss:`	WebSocket Secure URLs
`https://example.com`	Specific origin
`*.example.com`	Any subdomain of example.com

Common Policies

Strict Policy

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'

Moderate Policy

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.example.com

With Google Analytics

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com; img-src 'self' https://www.google-analytics.com; connect-src 'self' https://www.google-analytics.com

With YouTube Embeds

Content-Security-Policy: default-src 'self'; frame-src https://www.youtube.com https://www.youtube-nocookie.com; script-src 'self'

Browser Support

All modern browsers support CSP Level 2. Some CSP Level 3 features have limited support:

Feature	Chrome	Firefox	Safari	Edge
CSP Level 2	40+	31+	10+	15+
`strict-dynamic`	52+	52+	15.4+	79+
`report-to`	70+	No	No	79+
`trusted-types`	83+	No	No	83+