CSP script-src
Where executable script may come from. The directive that decides whether your CSP is worth anything.
- Falls back to
default-src- Group
- Fetch directives
Detail
Everything about CSP effectiveness comes down to this directive. 'unsafe-inline' here permits injected inline script and negates the policy — unless a nonce or hash is also present, in which case browsers ignore 'unsafe-inline' entirely. Prefer a per-response nonce plus 'strict-dynamic' over a host allowlist.
Example
script-src 'nonce-r4nd0m' 'strict-dynamic'