🛡
OneFreePlace
TOOL #397 · CSP WORKBENCH
Developer Tools · Browser hardening

Content Security Policy Builder

Build a nonce/hash-oriented CSP, audit unsafe allowances, add Trusted Types and reporting, test resource sources, calculate inline SHA-256 hashes, and export both HTTP and meta-tag forms with their limitations made explicit.

Local-first · cryptographic nonce/hash helpers

Directives

default-srcsource list
script-srcsource list
style-srcsource list
img-srcsource list
connect-srcsource list
font-srcsource list
media-srcsource list
frame-srcsource list
worker-srcsource list
object-srcsource list
base-urisource list
form-actionsource list
frame-ancestorssource list

Generated policy

Content-Security-Policy

Resource source tester

Policy findings

heuristic audit
A CSP is defense in depth, not a substitute for output encoding, safe DOM APIs, authentication or server-side authorization.

Per-response nonce

Generate a fresh unpredictable nonce for every HTTP response and apply the same value to the CSP and trusted script tags. Do not ship a static nonce.

Inline script/style hash

HTTP headers

Meta fallback
Meta-delivered CSP cannot provide Report-Only, report-uri/report-to, frame-ancestors or sandbox. Prefer the HTTP response header.