CSP: directive coverage, nonces, and browser enforcement

Mechanism

Content Security Policy restricts selected browser resource loads and script execution. A policy is meaningful only for the response where it is delivered and the directives controlling the relevant sink. Nonces must be unpredictable and bound to a response; an allowed script source can still host code or gadgets that accept unsafe data.

Practical method

Inspect enforced and report-only headers separately. Map the candidate execution route to script-src, default-src, or a more specific directive. Determine whether inline scripts use nonces or hashes and whether dynamically created scripts inherit trust. Verify behavior in the actual browser rather than inferring it from policy text alone.

Content-Security-Policy: default-src 'none'; script-src 'nonce-RANDOM'; object-src 'none'; base-uri 'none'

Interpreting evidence

A blocked request in the console confirms one enforcement event. It does not prove every script sink or navigation path is protected. Compare the exact policy and response involved.

Pitfalls and limits

Report-only policies do not block execution. unsafe-inline semantics interact with nonce/hash support. CSP is defense in depth and does not correct unsafe rendering or authorization logic.