CSP Analyzer

Paste enforced CSP header values without a header name. Commas separate policies, all of which must permit a request; this is not an intersection of their source lists. Analyze shows heuristic findings and fallback directives. URL check is a static source comparison, not a promise that a resource loads. No network requests or storage are used; fields stay in RAM across tool switches and reset on reload.

Script strict-dynamic, missing nonce/integrity context and insecure-request upgrades produce an explicit context result. No inline-code, nonce validity/uniqueness, SRI, redirect, CORS, mixed-content, Trusted Types, meta-CSP or report-only enforcement simulation. Checks compare initial URLs, without redirects. HTTP(S) page origins only. An empty policy imposes no source restriction. Unknown/invalid directives are reported; source grammar diagnostics are not comprehensive.

Parsed policy keeps the first duplicate directive, removes invalid names and normalizes whitespace, preserving policy boundaries. It is not a security recommendation or a semantic canonical form. Limits: 32,768 characters, 2,048 tokens, 16 policies. Preset nonces are public demonstration values, never production randomness.

W3C · Content Security Policy 3

Known Chromium differences from the current CSP3 matching text for encoded path separators, malformed percent escapes in source paths and ws:/wss: sources against HTTP(S) are reported as requiring context.