Parse a Content-Security-Policy header value, explain each directive and flag ri...

{ "method": "GET", "queryParams": { "value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *" }, "type": "http" }

{ "example": { "asOf": "2026-10-11T14:26:44.554Z", "degraded": false, "directiveCount": 3, "directives": [ { "directive": "default-src", "meaning": "Fallback for every fetch directive that is not set.", "policy": 1, "sources": "'self'" }, { "directive": "script-src", "meaning": "Where scripts may load from and whether inline scripts and eval run.", "policy": 1, "sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net" } ], "disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.", "flags": [ { "directive": "script-src", "fix": "Use nonces or hashes instead of 'unsafe-inline'.", "message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.", "severity": "HIGH" }, { "directive": "script-src", "fix": "Prefer nonces or hashes with 'strict-dynamic'.", "message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.", "severity": "MEDIUM" } ], "highCount": 1, "infoCount": 0, "lowCount": 4, "mediumCount": 2, "notChecked": [ "whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)", "your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value", "…3 more" ], "policyCount": 1, "reasons": [ "HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.", "MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.", "…5 more" ], "source": "W3C Content Security Policy Level 3 rules, computed locally", "summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.", "verdict": "CSP_HIGH_RISK" }, "type": "json" }