Content Security Policy (CSP) Generator: What It Does
Constructs Content Security Policy (CSP) HTTP headers with directive builders, nonces, and SHA hashes. It includes policy security scoring, flags dangerous bypasses (like 'unsafe-inline'), and exports server configs.
Example
default-src 'self'; script-src 'self' 'nonce-rAnd0m'Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-rAnd0m';Assembles directives into a standard CSP response header.
How to Use
- Configure directives (default-src, script-src, style-src, img-src) using checkboxes.
- Add trusted domains, nonces, or hash tokens for inline assets.
- Copy the header for Nginx, Apache, or HTML meta tag integration.
Limitations
- Audit scores evaluate policy strictness; actual browser enforcement must be tested live.
- HTML meta tags cannot enforce frame-ancestors, report-uri, or sandbox directives.
Frequently Asked Questions
Why is 'unsafe-inline' considered dangerous in a Content Security Policy?
'unsafe-inline' permits execution of arbitrary inline scripts, disabling the core defense CSP provides against Cross-Site Scripting (XSS).
What is the purpose of the Content-Security-Policy-Report-Only header?
Report-Only monitors and logs policy violations to an endpoint without actually blocking resources, letting you test policies safely before enforcement.
Related Tools
Decode X.509 certificates (PEM or DER) and Certificate Signing Requests: subject/issuer, SANs, validity, key details, extensions, and SHA-256/SHA-1 fingerprints.
Decode, encode, and verify JSON Web Tokens (JWT) safely in your browser with expiration countdown and signature verification.
Calculate IPv4 subnet masks, CIDR network address, broadcast address, and usable host ranges.
Generate standard HTML meta tags and Next.js App Router metadata with character count safety checks.