What is Content Security Policy?
Content Security Policy is an HTTP response header that limits which resources a browser may load and where sensitive actions may occur. It can reduce the impact of cross-site scripting and content injection, but it does not replace output encoding, input validation, secure dependencies, or other application security controls.
Important directives
default-src supplies a fallback for many resource types.script-src and style-src control executable scripts and stylesheets.img-src, font-src, media-src, and connect-src cover common subresources and network connections.object-src 'none' blocks legacy plugin content.base-uri restricts injected <base> elements.form-action limits form destinations.frame-ancestors controls which parents may embed the page.
Report-only before enforcement
Use Content-Security-Policy-Report-Only to observe violations without blocking resources. Exercise every application flow, review reports, remove accidental allowances, and only then switch to the enforcing header. Report-only mode does not protect the page by itself.
Avoid adding 'unsafe-inline' or 'unsafe-eval' simply to silence errors. Prefer nonces or hashes for necessary inline code and refactor string-to-code evaluation. A fresh nonce must be generated by the server for each response; this static builder intentionally does not create a reusable nonce.
Builder limits and privacy
The analyzer flags several common mistakes, but it cannot crawl an application, determine all required origins, validate browser support, or prove that a policy is secure. Unknown directives are not imported by the parser. Test the final header in the actual application and monitor violation reports.
All policy editing happens locally. Read the MDN CSP guide for current browser behavior. Use the Permissions-Policy Builder for powerful browser APIs, the Cache-Control Builder for caching, or the SRI Hash Generator for external resource integrity.