Browser security policies, demonstrated live

Each example sets a real response header. Watch what the browser allows or blocks.

Blocking injected scripts

The simplest CSP policy. See how default-src 'self' blocks injected inline scripts.

Origin allowlist

script-src origin

Trust scripts by origin URL. Any script loaded from a listed domain runs without a nonce or hash.

Per-request nonce

script-src nonce

A per-request random token in the header and script tag lets one specific inline script run.

script-src hash

A cryptographic hash of the script content. Only scripts whose content matches the hash are allowed.

Trusted script injection

script-src 'strict-dynamic'

Lets a trusted script inject further scripts, so third-party scripts work without allowlisting domains.

Split script directives

script-src-elem / attr

Split script rules by category. Allow inline event handlers while keeping <script> blocks protected by nonces.

Reporting

Violation report fields

See what a CSP violation report contains. Each mode triggers a different resource type and shows how blockedURL and effectiveDirective change.

effectiveDirective vs originalPolicy

See how effectiveDirective always names the specific subtype that matched, even when the policy only contains default-src.