CSP: script-src

HTTP の Content-Security-Policy (CSP) script-src ディレクティブは、 JavaScript の情報なソースを指定します。これは <script> 要素の中に直接読み込まれる URL だけでなく、インラインのスクリプトイベントハンドラー (onclick) やスクリプト実行のトリガーとなりうる XSLT スタイルシートのようなものも含まれます。

構文

script-src ポリシーには、１つまたは複数のソースが許可されています。

Content-Security-Policy: script-src <source>;
Content-Security-Policy: script-src <source> <source>;

ソース

例

違反例

この CSP ヘッダーがある場合、

Content-Security-Policy: script-src https://example.com/

以下のスクリプトはブロックされ、読み込みや実行が行われません。

<script src="https://not-example.com/js/library.js"></script>

なお、インラインのイベントハンドラーも同様にブロックされます。

<button id="btn" onclick="doSomething()">

これを addEventListener の呼び出しに置き換えてください。

document.getElementById("btn").addEventListener('click', doSomething);

安全ではないインラインのスクリプト

To allow inline scripts and inline event handlers, 'unsafe-inline', a nonce-source or a hash-source that matches the inline block can be specified.

Content-Security-Policy: script-src 'unsafe-inline';

The above Content Security Policy will allow inline <script> elements

<script> 
  var inline = 1; 
</script>

You can use a nonce-source to only allow specific inline script blocks:

Content-Security-Policy: script-src 'nonce-2726c7f26c'

You will have to set the same nonce on the <script> element:

<script nonce="2726c7f26c">
  var inline = 1;
</script>

Alternatively, you can create hashes from your inline scripts. CSP supports sha256, sha384 and sha512.

Content-Security-Policy: script-src 'sha256-B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF8='

When generating the hash, don't include the <script> tags and note that capitalization and whitespace matter, including leading or trailing whitespace.

<script>var inline = 1;</script>

Unsafe eval expressions

The 'unsafe-eval' source expression controls several script execution methods that create code from strings. If 'unsafe-eval' isn't specified with the script-src directive, the following methods are blocked and won't have any effect:

• eval()
• Function()
• When passing a string literal like to methods like: window.setTimeout("alert(\"Hello World!\");", 500);
  • window.setTimeout
  • window.setInterval
  • window.setImmediate
• window.execScript (IE < 11 only)

strict-dynamic

The 'strict-dynamic' source expression specifies that the trust explicitly given to a script present in the markup, by accompanying it with a nonce or a hash, shall be propagated to all the scripts loaded by that root script. At the same time, any whitelist or source expressions such as 'self' or 'unsafe-inline' will be ignored. For example, a policy such as script-src 'strict-dynamic' 'nonce-R4nd0m' https://whitelisted.com/ would allow loading of a root script with <script nonce="R4nd0m" src="https://example.com/loader.js"> and propagate that trust to any script loaded by loader.js, but disallow loading scripts from https://whitelisted.com/ unless accompanied by a nonce or loaded from a trusted script.

script-src 'strict-dynamic' 'nonce-someNonce'

Or

script-src 'strict-dynamic' 'sha256-base64EncodedHash'

It is possible to deploy strict-dynamic in a backwards compatible way, without requiring user-agent sniffing.
The policy:

script-src 'unsafe-inline' https: 'nonce-abcdefg' 'strict-dynamic'

will act like'unsafe-inline' https: in browsers that support CSP1, https: 'nonce-abcdefg' in browsers that support CSP2, and 'nonce-abcdefg' 'strict-dynamic' in browsers that support CSP3.

仕様書

ブラウザーの対応

このページの互換性一覧表は構造化データから生成されています。データに協力していただけるのであれば、 https://github.com/mdn/browser-compat-data をチェックアウトしてプルリクエストを送信してください。

No compatibility data found. Please contribute data for "http.headers.csp.script-src" (depth: 1) to the MDN compatibility data repository.

関連情報

• Content-Security-Policy
• <script>