CSP Header Generator

What is a Content Security Policy (CSP)?

A Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to the distribution of malware.

How does CSP work?

CSP is implemented by configuring your web server to return the Content-Security-Policy HTTP header. Alternatively, the <meta> element can be used to configure a policy, for example: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*;">

A primary goal of CSP is to mitigate and report XSS attacks. XSS attacks exploit the browser's trust in the content received from the server. By specifying the domains that the browser should consider to be valid sources of executable scripts, a CSP significantly reduces the attack surface.

Common CSP Directives

• default-src: Serves as a fallback for the other fetch directives.
• script-src: Specifies valid sources for JavaScript.
• style-src: Specifies valid sources for stylesheets.
• img-src: Specifies valid sources of images and favicons.
• connect-src: Restricts the URLs which can be loaded using script interfaces.
• font-src: Specifies valid sources for fonts loaded using @font-face.

Keywords

• 'self': Matches the current origin, but not subdomains.
• 'unsafe-inline': Allows the use of inline resources, such as inline <script> elements, javascript: URLs, inline event handlers, and inline <style> elements.
• 'unsafe-eval': Allows the use of eval() and similar methods for creating code from strings.
• 'none': Prevents loading any resources for this directive.