CSP Policy Workbench
Compare one supplied CSP header value and request samples locally. See which directive applies and how nonce and strict-dynamic can change the outcome.
Key features
- Show the effective directive and fallback for each resource kind
- Keep the first duplicate directive and warn about later copies
- Evaluate a bounded set of nonce, strict-dynamic, self, host and scheme cases
- Mark unsupported sources for review instead of asserting a false block
- Export JSON/CSV results and a sample-based policy draft
How to use
- Paste the document URL and a single enforcing CSP policy.
- Add script, image and other request URLs, with optional nonce and script insertion type.
- Run the comparison and inspect each allow, block or review explanation.
- Review risk signals and test the draft separately on your real site.
Use cases
- Review a CDN change before a release
- Inspect nonce and strict-dynamic interactions
- Find duplicate directives and unsafe-eval exposure
- Compare reported blocked URLs against a policy draft
Frequently asked questions
Does this inspect a live site or apply CSP?
No. It calculates from the supplied policy and samples in your browser. It neither fetches input URLs nor changes headers.
Does “allow” guarantee execution in the browser?
No. This is a bounded model of one enforcing policy. Other CSP headers, redirects, SRI, browser behavior and the actual response need separate checks.
What does “review” mean?
An unsupported source expression, hash requiring content or opaque URL prevents a firm allow/block conclusion from this input.
Can I deploy the draft as-is?
No. It only sketches origins seen in the supplied samples. It does not cover every page, request or nonce lifecycle.
Are nonce values or URL queries exported?
The report omits the original policy and nonce values and strips URL query and fragment. Paths and directive names may still be sensitive, so inspect before sharing.
Privacy
Policy and request inputs remain in this browser tab. No request is sent to an input URL or stored. Inspect URL paths and directive names before sharing exports.
References
Related Tools
Webhook Signature LabHTTP Archive AnalyzerMeta Tag GeneratorWasm Module InspectorHreflang Matrix CheckerAST Query PlaygroundContainer Build GraphDependency Graph ExplorerSemver Range LabCron Schedule AuditorPatch Review WorkbenchSource Map ExplorerLocalization Catalog AuditorStructured Data ReviewerProtobuf Schema WorkbenchGraphQL Schema LabAvro Schema EvolutionLocal SQL WorkbenchSchema Form BuilderMesh Repair WorkbenchPipe Network LabRobot Arm Kinematics LabThermal Network LabBeam Response LabGear Train DesignerTolerance Stackup LabSensor Calibration FitPCB Stackup PlannerDigital Filter DesignerNetwork Reachability MapSun Shadow MapGPS Error SimulatorDigital Logic SimulatorAnalog Circuit LabMechanism Linkage LabAnalysis Mesh GeneratorOpenAPI Contract InspectorDatabase Migration PlannerDimensional Equation CheckerTruss Force LabBoolean Minimization LabControl Response LabQueueing Simulation LabGeofence Event SimulatorCoordinate Reference LabSurvey Traverse LabRaster Classification LabChoropleth Design LabMap Print ComposerRaster Reprojection LabElevation Contour MakerTerrain Viewshed LabWatershed DelineatorMap Tile PackagerText File Encoding WorkbenchFilesystem Portability AuditorSBOM License ExplorerFile Signature Auditornpm Lockfile Conflict ResolverSource Secret AuditorOffline Web Package BuilderCertificate Chain InspectorTorrent Metainfo InspectorChunked File PackagerEncrypted File VaultDuplicate File FinderArchive WorkbenchDesign Token ManagerSpacing Token DesignerResponsive Type SystemPackaging Dieline DesignerSVG Icon Sprite PackerFlex Layout PlaygroundCSS Grid PlaygroundRegex Equivalence LabMarkdown Repository AuditorLog Template MinerResponsive Layout AuditorEmail Template PreviewInternal Link GraphState Machine TesterPetri Net SimulatorGit History VisualizerCurl Request WorkbenchBinary Protocol DesignerHex File EditorBinary Patch WorkbenchFile Signature WorkbenchAPI Mock SandboxSchema Column MapperEvent Log SessionizerER Diagram DesignerTime Series Gap AuditorStratified Data SplitterData Lineage DesignerDecision Tree LabData Anonymization WorkbenchData Expectation RunnerJSON Schema ValidatorBasket Pattern AnalyzerRobots Policy TesterSEO HTML AuditorAccessibility Structure AuditorSyndication Feed WorkbenchIndexNow Payload BuilderCrawl Log AnalyzerSearch Performance AnalyzerCSV Formula Risk AuditorCORS Response SimulatorCache Header LabCookie Policy InspectorWeb Vitals Trace LabSitemap Health AuditorBatch File RenamerFile Manifest VerifierFolder Space MapFolder Difference ReviewerRoute Order OptimizerGeoJSON Map EditorPolygon Overlay LabCartographic Label PlacerSpatial Table JoinGeoJSON Topology AuditorGPX Track AnalyzerTrack Privacy RedactorCSV Table JoinCSV Pivot WorkbenchScientific Data ProfilerTabular Cleaning WorkbenchRecord ReconciliationData Dictionary BuilderCanonical Graph AuditorRedirect Plan TesterHTTP response and ping reference testBrowser and System InformationJSON ↔ YAML ConverterXML ↔ JSON ConverterHTML FormatterJavaScript MinifierMock Data Generator.gitignore GeneratorLicense GeneratorUser-Agent ParserPassword Strength CheckerCode to ImageXML FormatterHTTP Status Code LookupMIME Type LookupJS & SQL String EscapeCSS Box Shadow GeneratorCSS Gradient GeneratorIndent ConverterNumber Base ConverterUnicode Escape ConverterUnicode InspectorJSON Structure DiffMarkdown Table GeneratorBase64 EncoderJSON FormatterURL EncoderSQL FormatterCron Expression GeneratorRegex TesterUUID GeneratorHash GeneratorTimestamp ConverterJWT DecoderHTML Entity ConverterMarkdown PreviewCSS MinifierJSON ↔ CSVCase ConverterImage to Base64
Comments & questions