~/tools $ ./csp --audit
CSP Analyzer
Paste a Content-Security-Policy and find unsafe sources, bypassable allowlists, and missing directives.
Runs entirely in your browser. Nothing you paste is sent anywhere.
What a CSP is for
A Content Security Policy tells the browser which sources may supply scripts, styles, frames, and other content. It does not prevent cross-site scripting bugs. It limits what an injected payload can do once one exists, which makes it one of the most effective defense-in-depth headers when it is strict.
Allowlists versus nonces
Research from Google found that the large majority of host allowlist policies were bypassable, because popular CDNs and APIs host JSONP endpoints and old framework versions that execute attacker-controlled input. A per-response nonce with 'strict-dynamic' avoids the problem entirely. Read more in theXSS guide.