Home

Overview

CSP Parser and Evaluator in Go is a CLI tool and library which can evaluate a Content-Security-Policy value, and provide actionable feedback about how to improve it. There is tooling and reporting that we want to be able to do in the future, but having a strong parser/evaluator is the first step.

• Web interface for evaluating a CSP policy?
• CSP generator from a sitemap?
• CSP policy modernizer?
• Receiver of CSP violation reports?

See the sidebar for more detailed information and recommendations.

References

• Content Security Policy Level 2 (formal recommendation)
• Content Security Policy Level 3 (working draft)
• web.dev: Content security policy
• MDN: Content Security Policy (CSP)
• OWASP: Content security policy (outdated)
• content-security-policy.com
• Can I use: Content Security Policy?
• Mozilla HTTP Observatory
• csp-evaluator