Question 1

What is a Content Security Policy (CSP)?

Accepted Answer

A Content Security Policy is an HTTP response header (or meta tag) that tells the browser which sources scripts, styles, images, fonts, frames and other resource types may load from. A well-built CSP is one of the most effective XSS mitigations available. It is defined per the W3C CSP Level 3 specification.

Question 2

Why does this tool also evaluate the policy I built?

Accepted Answer

Because many 'CSP generators' ship policies that look complete but don't actually stop XSS — they allow 'unsafe-inline', broad wildcards like https:, or omit object-src/base-uri. This tool runs Google-CSP-Evaluator-style heuristics as you build, so you see XSS-bypass warnings the moment they appear, plus recommendations to move to nonce + strict-dynamic.

Question 3

What is the strict-dynamic + nonce pattern and should I use it?

Accepted Answer

strict-dynamic (CSP3) lets a trusted script (loaded with a per-request nonce) load its own dependencies without an allowlist. It is the Google-recommended pattern because allowlist-based CSPs are routinely bypassed. This tool generates per-page nonces (base64, 128 bits) and SHA-256 hashes for inline scripts, with guidance for migrating off allowlists.

Question 4

Does Report-Only mode and reporting work in this tool?

Accepted Answer

Yes. You can switch to Content-Security-Policy-Report-Only, configure report-to / report-uri endpoints, and the tool emits a Report-To header JSON object alongside the policy. Reports themselves are sent by browsers at runtime — this tool only builds the configuration; no report data ever reaches us.

Question 5

What extras does this tool include?

Accepted Answer

(1) Live XSS-bypass evaluator with severity ratings. (2) Strict-CSP preset (nonce + strict-dynamic). (3) Per-directive plain-English docs. (4) Nginx, Apache, and HTML meta-tag output formats. (5) Report-Only toggle + report-to/report-uri config. (6) Paste-existing-CSP audit mode. (7) Nonce + SHA-256 hash generators for inline scripts. (8) Browser-support notes per directive (CSP2 vs CSP3). (9) Copy per output format. (10) Shareable URL encoding the policy config (no secrets — CSP is public). (11) Bypass-gadget detection for Angular/Prototype.js/JSONP. (12) Strict-CSP presets for SPA/SSR/static/API apps.

Question 6

Which directives does this builder support?

Accepted Answer

All CSP3 fetch directives (default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, child-src, worker-src, manifest-src, prefetch-src), plus frame-ancestors, base-uri, form-action, sandbox, upgrade-insecure-requests, require-trusted-types-for, trusted-types, report-uri, report-to, and the strict-dynamic / unsafe-hashes keywords.

Question 7

Is my data sent anywhere?

Accepted Answer

No. Policy building, evaluation, nonce generation, and hashing all run in your browser. Shareable URLs encode the policy configuration in the fragment (#) which browsers do not transmit in HTTP requests. A CSP header is inherently public information — there are no secrets in it.

Question 8

What does the bypass-gadget detector look for?

Accepted Answer

It flags known script-hosting sources that can be abused to bypass CSP when allowlisted in script-src: Angular on gstatic.com (via $eval), Prototype.js, JSONP endpoints on common CDNs (jsdelivr, cdnjs, gstatic), and data: URIs. For each gadget it suggests a safer alternative.

CSP Generator

How to use