Allow only the scripts you wrote

How to do it

On static pages, put the hash of each inline script and style in the policy ('sha256-…'). Load the bundle from a small hashed inline script, which 'strict-dynamic' then trusts. On dynamic pages, use a fresh random nonce of at least 128 bits per response, never a fixed one. Add default-src 'self', object-src 'none', base-uri 'none' and report-to. Put frame-ancestors in the same header, as Refuse to be framed requires. A strict script policy is a second line of defence behind escaping, so it is Recommended, while framing protection stands alone and is Required. Remove inline style= attributes and on…= event handlers, because hashes do not cover them. Try Content-Security-Policy-Report-Only first, then switch to enforcing.

Examples

HTTP example

Content-Security-Policy: default-src 'self';
  script-src 'sha256-AbC123...=' 'strict-dynamic';
  style-src 'self' 'sha256-XyZ789...=';
  object-src 'none'; base-uri 'none'; frame-ancestors 'none';
  upgrade-insecure-requests; report-to csp-endpoint

HTML example

<!-- The hash of this loader is in script-src. 'strict-dynamic' trusts what it loads. -->
<script>
  const s = document.createElement('script');
  s.src = '/app.3f9a1c.js';
  s.type = 'module';
  s.integrity = 'sha384-…';   // so an Integrity-Policy still lets it run
  document.head.append(s);
</script>

JavaScript example

// Express: a fresh nonce per response
import { randomBytes } from 'node:crypto';
app.use((req, res, next) => {
  res.locals.nonce = randomBytes(16).toString('base64');
  res.set('Content-Security-Policy', `script-src 'nonce-${res.locals.nonce}' 'strict-dynamic'; object-src 'none'; base-uri 'none'`);
  next();
});

Python example

# Flask: a fresh nonce per response, used in templates as {{ g.nonce }}
import secrets

@app.before_request
def make_nonce():
    g.nonce = secrets.token_urlsafe(16)

@app.after_request
def csp(response):
    response.headers["Content-Security-Policy"] = f"script-src 'nonce-{g.nonce}' 'strict-dynamic'; object-src 'none'; base-uri 'none'"
    return response

How to check

curl -sI shows a script-src with a nonce or hash and without 'unsafe-inline', 'unsafe-eval' or *. The console shows no violations. A CSP evaluator, such as Google's, reports no high-severity findings.

Sources

• W3C Content Security Policy Level 3
• OWASP Content Security Policy Cheat Sheet

Related rules

• WEB-209 Host everything yourself for privacy in Website
• PAY-76 Guard every script on a payment page in Payments and billing
• STK-57 Use nginx or Caddy as the web server and reverse proxy in Software choices
• MOB-46 Keep web views to your own pages in Mobile apps
• DSK-10 Keep web content away from the operating system in Desktop apps and extensions
• APS-3 Escape everything you show in Application security
• APS-28 Refuse to be framed in Application security