CSP Evaluator
Spot the weak sources and mistakes of a Content-Security-Policy, and test URLs against it
Policy
A policy, a Content-Security-Policy header, a <meta> tag or an nginx / Apache line. Everything happens on your device.
Test URLs
Enter an http:// or https:// URL.
Findings
Directives
Inline code
How browsers read a policy
- Fallbacks
- A fetch directive not set uses
default-src(script-src-elemfirst usesscript-src,frame-srcuseschild-src…).base-uri,form-actionandframe-ancestorshave no fallback: not set, they allow anything. - Nonces and hashes
- A nonce or a hash in a list makes browsers ignore
'unsafe-inline'there, so it can stay for older browsers. A nonce must be random and new on every response. 'strict-dynamic'- The scripts a trusted script (one with the nonce or a listed hash) adds are trusted too; hosts, schemes and
'self'are then ignored. - Paths
- A path in a source (
https://cdn.example.com/lib/) is not checked after a redirect: an open redirect on an allowed host escapes it. - Header or <meta>
- A
<meta>tag can't setframe-ancestors,sandboxor reporting, nor be report-only, and only covers what comes after it. - Several policies
- Browsers enforce each one: a resource loads only if all of them allow it. In a header, a comma starts another policy.