Source Value

Example

Description

*

img-src *

Wildcard, allows any URL except data: blob: filesystem: schemes.

'none'

object-src 'none'

Prevents loading resources from any source.

'self'

script-src 'self'

Allows loading resources from the same origin (same scheme, host and port).

data:

img-src 'self' data:

Allows loading resources via the data scheme (eg Base64 encoded images).

domain.example.com

img-src domain.example.com

Allows loading resources from the specified domain name.

*.example.com

img-src *.example.com

Allows loading resources from any subdomain under example.com.

https://cdn.com

img-src https://cdn.com

Allows loading resources only over HTTPS matching the given domain.

https:

img-src https:

Allows loading resources only over HTTPS on any domain.

'unsafe-inline'

script-src 'unsafe-inline'

Allows use of inline source elements such as style attribute, onclick, or script tag bodies (depends on the context of the source it is applied to) and javascript: URIs

'unsafe-eval'

script-src 'unsafe-eval'

Allows unsafe dynamic code evaluation such as JavaScript eval()

'sha256-'

script-src 'sha256-xyz...'

Allows an inline script or CSS to execute if its hash matches the specified hash in the header. Currently supports SHA256, SHA384 or SHA512. CSP Level 2

'nonce-'

script-src 'nonce-rAnd0m'

Allows an inline script or CSS to execute if the script (eg: <script nonce="rAnd0m">) tag contains a nonce attribute matching the nonce specifed in the CSP header. The nonce should be a secure random string, and should not be reused. CSP Level 2

'strict-dynamic'

script-src 'strict-dynamic'

Enables an allowed script to load additional scripts via non-"parser-inserted" script elements (for example document.createElement('script'); is allowed). CSP Level 3

'unsafe-hashes'

script-src 'unsafe-hashes' 'sha256-abc...'

Allows you to enable scripts in event handlers (eg onclick). Does not apply to javascript: or inline <script> CSP Level 3