# Values (/en/docs/web-security/policies/content-security-policy/introduction/csp-values) Most Content Security Policy (CSP) directives take a space-separated list of source expressions, the values that say what the directive allows. A source expression can be a keyword, a host, a scheme, a nonce, or a hash. This page is the index of those value types and links each one to its full reference. For the directives that consume these values, see the [directives overview](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives); for how a policy is delivered, see the [headers overview](/en/docs/web-security/policies/content-security-policy/introduction/csp-headers). A compact policy that mixes a keyword, a nonce, and a scheme source: ```http Content-Security-Policy: script-src 'self' 'nonce-{RANDOM}'; img-src 'self' data: ``` ## The value types [#the-value-types] | Value type | Status | What it matches | Example | | ------------------------------------------------------------------------------------------------- | --------------- | ------------------------------------------------------- | -------------------------------------- | | [Keyword](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) | ✅ Good | Single-quoted tokens with fixed meanings | `'self'`, `'none'`, `'strict-dynamic'` | | [Host source](/en/docs/web-security/policies/content-security-policy/values/csp-host-source) | ✅ Good | A host, optionally with scheme, port, path, or wildcard | `cdn.example.com`, `*.example.com` | | [Scheme source](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source) | ✅ Good | A whole URL scheme | `https:`, `data:`, `blob:` | | [Nonce](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) | ✅ Good | A per-response token matching a `nonce` attribute | `'nonce-r4nd0m'` | | [Hash](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) | ✅ Good | A digest of an inline script or style | `'sha256-...'` | | [report-sample](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) | ✅ Good | Includes a sample of the blocked content in the report | `'report-sample'` | | [report-sha256](/en/docs/web-security/policies/content-security-policy/values/report-sha-keyword) | 🧪 Experimental | Report-only script hash collection, Chromium-only | `'report-sha256'` | Status here rates the value type, not each individual value: `'unsafe-inline'` is a keyword and `*` is a host source, and both are unsafe. The per-keyword statuses live on the [keywords page](/en/docs/web-security/policies/content-security-policy/values/csp-keywords). ## Keywords [#keywords] Keywords are single-quoted tokens with fixed meanings, set out on the [keywords](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) page. The ones you reach for most: * `'self'` matches the page's own origin (same scheme, host, and port), not its subdomains, and does not allow inline code. * `'none'` matches nothing and is used on its own to block a resource type. * `'unsafe-inline'` allows inline scripts and styles, but it is ignored when a nonce or hash is present in the same directive. * `'strict-dynamic'` propagates trust from a nonce- or hash-allowed script to the scripts it loads, and makes host and scheme entries ignored. It is the basis of a strict policy. * `'trusted-types-eval'` is a newer keyword that allows `eval()` only with a `TrustedScript` when Trusted Types are enforced, as a replacement for `'unsafe-eval'`. ## Host and scheme sources [#host-and-scheme-sources] A [host source](/en/docs/web-security/policies/content-security-policy/values/csp-host-source) allowlists a host, with an optional scheme, port, path, or leading `*.` wildcard. `*.example.com` matches subdomains but not `example.com` itself, and a bare `*` does not match `data:`, `blob:`, or `filesystem:`. A [scheme source](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source) allowlists an entire scheme, such as `https:` or `data:`. Allowing `data:` in `script-src` or `style-src` is dangerous; it is usually safe only in `img-src` or `font-src`. ## Nonces and hashes [#nonces-and-hashes] A [nonce or hash](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) lets you allow a specific inline script or style without opening the door to all inline code. * A nonce is a server-generated, unguessable token, unique to each response, set both in the policy as `'nonce-...'` and on the matching element's `nonce` attribute. * A hash is a digest of the exact inline content, written as `'sha256-...'`, `'sha384-...'`, or `'sha512-...'`. The browser hashes the element and allows it only if the digest matches. You can compute a digest for inline content with the [hash generator](/tools/csp-hash), and produce an integrity attribute for an external resource with the [SRI generator](/tools/sri-hash). ## Reporting values [#reporting-values] [report-sample](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) is a keyword you add to a directive to include the first part of the blocked inline content as a `sample` field in the violation report, which makes a block easier to track down. Separately, the report-only hash keywords [report-sha256, report-sha384, and report-sha512](/en/docs/web-security/policies/content-security-policy/values/report-sha-keyword) tell the browser to report the hashes of the scripts on a page rather than to enforce anything. CentralCSP uses that mechanism to build a [script inventory and SBOM](/platform/supply-chain) of everything running on each page. The keywords are stable in current Chrome and in the CSP3 editor's draft grammar, but remain Chromium-only. ## See also [#see-also] * [What is CSP](/en/docs/web-security/policies/content-security-policy/introduction/what-is-csp) * [CSP directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives) * [CSP headers](/en/docs/web-security/policies/content-security-policy/introduction/csp-headers) * [Keywords](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) * [Hashes and nonces](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) ## Sources [#sources] * [MDN, Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy) * [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/) * [web.dev, Mitigate cross-site scripting with a strict CSP](https://web.dev/articles/strict-csp)