Values

Most Content Security Policy (CSP) directives take a space-separated list of source expressions, the values that say what the directive allows. A source expression can be a keyword, a host, a scheme, a nonce, or a hash. This page is the index of those value types and links each one to its full reference.

For the directives that consume these values, see the directives overview; for how a policy is delivered, see the headers overview.

A compact policy that mixes a keyword, a nonce, and a scheme source:

Content-Security-Policy: script-src 'self' 'nonce-{RANDOM}'; img-src 'self' data:

The value types

Status here rates the value type, not each individual value: 'unsafe-inline' is a keyword and * is a host source, and both are unsafe. The per-keyword statuses live on the keywords page.

Keywords

Keywords are single-quoted tokens with fixed meanings, set out on the keywords page. The ones you reach for most:

• 'self' matches the page's own origin (same scheme, host, and port), not its subdomains, and does not allow inline code.
• 'none' matches nothing and is used on its own to block a resource type.
• 'unsafe-inline' allows inline scripts and styles, but it is ignored when a nonce or hash is present in the same directive.
• 'strict-dynamic' propagates trust from a nonce- or hash-allowed script to the scripts it loads, and makes host and scheme entries ignored. It is the basis of a strict policy.
• 'trusted-types-eval' is a newer keyword that allows eval() only with a TrustedScript when Trusted Types are enforced, as a replacement for 'unsafe-eval'.

Host and scheme sources

A host source allowlists a host, with an optional scheme, port, path, or leading *. wildcard. *.example.com matches subdomains but not example.com itself, and a bare * does not match data:, blob:, or filesystem:.

A scheme source allowlists an entire scheme, such as https: or data:. Allowing data: in script-src or style-src is dangerous; it is usually safe only in img-src or font-src.

Nonces and hashes

A nonce or hash lets you allow a specific inline script or style without opening the door to all inline code.

• A nonce is a server-generated, unguessable token, unique to each response, set both in the policy as 'nonce-...' and on the matching element's nonce attribute.
• A hash is a digest of the exact inline content, written as 'sha256-...', 'sha384-...', or 'sha512-...'. The browser hashes the element and allows it only if the digest matches.

You can compute a digest for inline content with the hash generator, and produce an integrity attribute for an external resource with the SRI generator.

Reporting values

report-sample is a keyword you add to a directive to include the first part of the blocked inline content as a sample field in the violation report, which makes a block easier to track down.

Separately, the report-only hash keywords report-sha256, report-sha384, and report-sha512 tell the browser to report the hashes of the scripts on a page rather than to enforce anything. CentralCSP uses that mechanism to build a script inventory and SBOM of everything running on each page. The keywords are stable in current Chrome and in the CSP3 editor's draft grammar, but remain Chromium-only.

See also

• What is CSP
• CSP directives
• CSP headers
• Keywords
• Hashes and nonces

Sources

• MDN, Content-Security-Policy
• W3C, Content Security Policy Level 3
• web.dev, Mitigate cross-site scripting with a strict CSP