Content Security Policy Browser Test

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.0.0 Safari/537.36 Prerender (+https://github.com/prerender/prerender)

JavaScript CSP Browser Test CSP Level 1

Note this test requires that you have JavaScript Enabled

CSP Supported

If you can read this, then the inline JavaScript below this line did not execute.

<script>
  //if CSP is supported this will not run
  window.onload=function(){
      var jsNode = document.getElementById("jsNode");
      jsNode.innerHTML = "<h3> CSP Not Supported</h3> Your browser does not support CSP, the inline script executed and replaced this div content";
      jsNode.className = "alert alert-danger";
  };
</script>

Image CSP Browser Test CSP Level 1

This test attempts to load an image: https://unsplash.it/200/200

<img src="https://unsplash.it/200/200" alt="CSP Should Block This Image From Loading" id="cspImg">

CSP Should Block This Image From Loading

If you see a gray box above then the image loading failed (presumably due to CSP, but it could also fail for other reasons such as the server being down).

JavaScript Hash Test CSP Level 2

CSP Level 2 does allow execution of inline scripts if a Hash is present in the script-src directive.

CSP Level 2 Inline Hash Supported

JavaScript Unsafe Hashes Test CSP Level 3

CSP Level 3 unsafe-hashes within script-src directive.

CSP Browser Test