CSP 'strict-dynamic'

A script-src keyword that discards the host allowlist and propagates trust from nonces instead.

Falls back to

nothing — must be set explicitly

Group

Source keywords

Detail

With 'strict-dynamic', a script that was trusted — because it carried the right nonce — may load further scripts, and the host allowlist is ignored entirely. This is the recommended modern approach, because allowlists are bypassable whenever any listed host serves a JSONP endpoint or an outdated library. It requires a nonce or hash to be present; without one, nothing is trusted and the page breaks.

Example

Analyse a full policy → · Generate one →