CSP 生成器

根据每个域的规则生成 Content Security Policy 标头

仅作为起点

生成的 CSP 仅为起点。请针对实际 asset graph 进行测试,并在部署前审查 unsafe-inline / unsafe-eval。

Directive	Sources
`default-src`
`script-src`
`style-src`
`img-src`
`connect-src`
`font-src`
`frame-src`
`media-src`

Content-Security-Policy 标头

Minified

Pretty

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-src 'none'; media-src 'self'

单击下面每个指令下的芯片来附加常见的源令牌。

使用方法

Review the directives table and type or paste sources into each directive row (script-src, style-src, img-src, etc.).
上传并选择
Toggle between Minified and Pretty output views to suit your use case.
Copy the generated Content-Security-Policy header value and paste it into your server configuration or meta tag.

示例

Adding 'self' and https://cdn.example.com to script-src produces script-src 'self' https://cdn.example.com in the header output.
Leaving all directives empty and adding only default-src 'none' produces a strict deny-all baseline policy.

生产环境使用前请验证输出。无担保 — 参见条款.