DEVELOPER UTILITIES / LOCAL TOOL
CSP Builder
Build a Content Security Policy and flag risky directives.
HOW IT WORKS
Assembling Content Security Policy directives
Selected source expressions are normalized into a CSP header value. The builder calls out broad sources and common unsafe script/style allowances.
Limits to keep in mind
A syntactically valid policy can still break a site or fail to block an attack. Nonce and hash workflows depend on server-generated values and are not configured here.
A PRACTICAL WORKFLOW
Use the result carefully.
01Enter source expressions for the directives you need, then build the policy string and review its warnings.
02Run the utility and inspect the complete output.
03Begin with report-only on a staging environment, then review browser reports and remove sources the site does not need.
COMMON QUESTION
Does the builder guarantee a secure policy?
No. You must adapt and test the result for the application.