Content-Security-Policy: directives, sources and reporting

A policy is a list of directives separated by semicolons, each naming a resource type and the sources allowed for it. Matching happens per request: the browser resolves the URL it is about to fetch, compares it against the source list for that directive, and refuses the fetch if nothing matches. Blocked resources appear in the console as a policy violation rather than a network error, which is the fastest way to tell the two apart.

default-src is the fallback for fetch directives you did not write, so default-src 'self' quietly covers script-src, img-src, style-src, connect-src and the rest. It does not cover frame-ancestors, base-uri or form-action, and those three carry real weight: frame-ancestors is what actually stops clickjacking, base-uri stops an injected base element rewriting every relative URL on the page, and form-action stops a form posting your fields to somebody else.

The unsafe-inline source allows every inline script and event handler attribute on the page, which puts you back roughly where you started against injected markup. The replacements are a per response nonce, where each script tag you control carries a nonce attribute matching the header, or a hash of the exact script body. A nonce must be unguessable and regenerated on every response, so it cannot live in a cached HTML file.

Roll a policy out with Content-Security-Policy-Report-Only first, collect violations for a week, then move the same string to the enforcing header. Two policies sent at once are intersected rather than combined, so an enforcing header plus a looser second header does not loosen anything: a request has to pass every policy that was sent.