Content Security Policy: which page actions may proceed?

DOM

The browser’s structured representation of a document, made of objects called nodes.

HTML

A language for describing the elements and structure of a web page.

SRI

A browser check comparing a downloaded resource with expected cryptographic digest information.

non-parser-inserted

Introduced by the shown script loader instead of by parsing an ordinary script tag in HTML.

default-src

Fallback for fetch rules that have no more specific directive.

script-src

Script source rules; also governs eval-like execution checks.

script-src-elem

Script elements, including files and inline script blocks.

script-src-attr

Inline script event handlers such as onclick.

style-src

Stylesheets and fallback rules for style elements/attributes.

style-src-elem

Style elements and stylesheet link elements.

style-src-attr

Style attributes on individual elements.

img-src

Restricts where this page’s images and small tab icons may be loaded from.

connect-src

Script connections such as fetch, XHR and WebSocket.

font-src

Fonts loaded by the page.

media-src

Audio, video and track resources.

object-src

Object and embed resources.

manifest-src

Restricts where a page can load the file describing an installable web app.

frame-src

Child frames this page loads.

child-src

Fallback for frame-src and worker-src.

worker-src

Worker, SharedWorker and ServiceWorker script loads.

base-uri

Allowed base element URLs; no default-src fallback.

sandbox

Removes capabilities such as scripts, forms or same-origin identity unless specific allowances restore them. Not delivered through meta or enforced by Report-Only.

form-action

Destinations for form submissions; no default-src fallback.

frame-ancestors

Every ancestor that embeds this page must match; header only, no default-src fallback.

report-to

Names a reporting endpoint group; the URL mapping is supplied separately.

report-uri

Legacy report destination URL; ignored when a supported report-to directive applies.

upgrade-insecure-requests

Rewrites eligible insecure requests to HTTPS; does not guarantee the destination supports HTTPS or authorize it through other gates.

require-trusted-types-for

Requires designated DOM injection sinks to receive appropriate Trusted Types values instead of ordinary strings. A separate feature with varying browser support.

trusted-types

Restricts creation of Trusted Types policy names. It does not make a policy’s transformation safe by itself.

fenced-frame-src

Sources for fenced frames; outside this simulator.

prefetch-src

Older proposed prefetch control; outside this simulator.

block-all-mixed-content

Older mixed-content restriction; not a current deployment recommendation.

CSP

Content Security Policy: rules a browser applies to actions by a protected page.

directive

One named rule inside a CSP policy.

CSP policy

A set of browser restrictions delivered together for a page.

source list

Alternative sources or permission expressions within one directive.

source expression

One item describing what a CSP source list allows.

'self'

A CSP source expression referring to the protected page’s origin.

'none'

When used alone in a source list, permits no sources for that rule.

fallback

The next rule to consult when a more specific rule is absent.

nonce

An unpredictable permission label attached to selected script or style elements for one response.

hash-source

A CSP permission based on a digest of exact code text.

SHA-256

A calculation that turns bytes into a fixed-length 256-bit digest.

inline script

Code written directly inside an HTML script element rather than loaded as a separate file.

event handler

Code attached to an event, such as a click on a button.

eval

A JavaScript operation that interprets a string as code.

unsafe-inline

A broad CSP source keyword permitting inline script or style behavior where applicable.

unsafe-hashes

A CSP source keyword allowing matching hashes to authorize certain inline attributes and script-like navigation.

strict-dynamic

A CSP source keyword that changes script-loading rules in supporting browsers.

parser-inserted

Introduced as part of parsing HTML, rather than created through the shown script loader.

Report-Only

A policy disposition that observes violations without enforcing blocking by that policy.

violation

An attempted action that does not satisfy a policy’s applicable rule.

ancestor

A page surrounding an embedded page, directly or through other nested frames.

worker

A separate browser execution context for background work, using a script.

origin

The scheme, host and port that identify a web origin.

CDN

Content delivery network: servers used to distribute files to readers.

XSS

Cross-site scripting: unwanted code runs in a page’s context.

Trusted Types

Browser values used to restrict dangerous conversions from strings into executable or document content.

injection sink

An API or operation where supplied text can become active document content or code.

meta element

An HTML element that can supply certain page metadata, including a limited CSP.

reporting endpoint group

A named reporting destination whose URL mapping is delivered separately.

disposition

Whether a policy is enforced as a restriction or monitored for violations.

Look up a term in the glossary ↗