Content-Security-Policy Builder

Composes a Content-Security-Policy header from a directive-by-directive form. Each directive accepts a space-separated source list (keywords like 'self', 'none', 'unsafe-inline', or scheme/host sources). The tool flags policies that contain unsafe-inline, unsafe-eval, or a wildcard, omits empty directives from the output, and emits both the response header form and the equivalent <meta> tag (in report-only mode only the header, because browsers ignore a report-only policy delivered by <meta>). Switch to report-only mode while you're rolling a new policy out to production.

The two output forms are not equivalent, despite looking it. A <meta> tag cannot carry frame-ancestors, report-uri or sandbox, and it takes effect only from where it appears in the document, so anything the parser has already reached is unprotected. The response header has none of those limits and is the form to prefer whenever you control the server.

default-src is a fallback and not a floor. Directives that are absent inherit from it, but any directive you do write replaces it outright for that resource type, so adding script-src https://cdn.example.com to a policy with a strict default-src 'self' drops 'self' for scripts unless you list it again. Several directives, frame-ancestors and base-uri among them, do not fall back to default-src at all and are simply unrestricted when omitted.

'unsafe-inline' deserves the warning it gets, because it disables the protection most policies exist for. It is also silently ignored in any policy that carries a nonce or a hash, which is the modern way to allow specific inline scripts, and that interaction is a common source of a policy that behaves differently from how it reads.

Report-only mode is the right way to deploy. The browser evaluates the policy, reports what would have broken and blocks nothing, which surfaces the third-party scripts and inline handlers you had forgotten. Do note that the two headers are independent: shipping a report-only policy does not weaken an enforcing one you already serve, and neither does it enforce anything on its own.