Build a Content-Security-Policy from allowed sources.
Your input stays in this browser.
Starting points for your own code. Run them in the environment shown below.
Node.js 22+ · ES module (.mjs)
Current inputs apply only to fields used by the example. Selected files are not embedded.
Install dependencies
const directives = {
"default-src": ["'self'"],
"script-src": ["'self'", "https://cdn.example.com"],
"object-src": ["'none'"],
"base-uri": ["'self'"],
"frame-ancestors": ["'none'"],
};
const policy = Object.entries(directives)
.map(([name, values]) => name + " " + values.join(" "))
.join("; ");
console.log("Content-Security-Policy: " + policy);Build a Content-Security-Policy from allowed sources.
Enter space-separated sources. Test with Report-Only on your actual page first.
Text 1 MB
Split inputs that exceed the limit. If a format or algorithm is unsupported, choose a tool that matches your requirements instead of silently changing the format.