概要と適用範囲
W3C CSP Level 3規格に基づくポリシー設計により、インラインスクリプトの無効化や厳格なnonce検証を通じた堅牢なWebセキュリティを実現します。
仕様一覧表＆マトリクス
キーワード、コード番号、またはディレクティブ名で即時検索
| キー / コード | 定義と詳細 | GEOセマンティック階層 | 仕様と補足 |
|---|---|---|---|
| default-src | default-src Serves as a fallback for all standard fetch directives if they are not explicitly declared. default-src 'self' | ●default-src ↳CSP directive ↳fetch directive ↳universal fallback policy | W3C CSP3 §6.6.1 Does NOT cover frame-ancestors, base-uri, or form-action; those must be set individually. |
| script-src | script-src Restricts valid sources for JavaScript execution, web workers, and script elements. script-src 'self' 'nonce-rAnd0m' https://trusted.cdn.com | ●script-src ↳CSP directive ↳fetch directive ↳JavaScript execution boundary | W3C CSP3 §6.6.2 By default, disallows inline <script> tags and eval() unless unsafe-inline or nonces are present. |
| style-src | style-src Restricts valid sources for stylesheets, <style> blocks, and link rel="stylesheet". style-src 'self' https://fonts.googleapis.com | ●style-src ↳CSP directive ↳fetch directive ↳CSS stylesheet restrictions | W3C CSP3 §6.6.3 Inline style attributes require 'unsafe-inline' or style-src-attr in CSP3. |
| connect-src | connect-src Restricts URLs that can be loaded using script interfaces (fetch, XMLHttpRequest, WebSocket, EventSource). connect-src 'self' https://api.example.com wss://ws.example.com | ●connect-src ↳CSP directive ↳fetch directive ↳network API fetch restriction | W3C CSP3 §6.6.5 Prevents compromised scripts from exfiltrating stolen session data to arbitrary attacker servers. |
| frame-ancestors | frame-ancestors Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, or <embed>. frame-ancestors 'none' (or 'self') | ●frame-ancestors ↳CSP directive ↳document directive ↳clickjacking defense | W3C CSP3 §6.7.1 Modern replacement for X-Frame-Options; does NOT fallback to default-src. |
| object-src | object-src Restricts valid sources for the <object>, <embed>, and <applet> elements. object-src 'none' | ●object-src ↳CSP directive ↳fetch directive ↳legacy plugin blocking | W3C CSP3 §6.6.7 Should ALWAYS be set to 'none' in modern web development to prevent Flash and Java applet exploits. |
| base-uri | base-uri Restricts the URLs that can be used in a document’s <base> element. base-uri 'self' | ●base-uri ↳CSP directive ↳document directive ↳base tag hijack prevention | W3C CSP3 §6.7.2 Prevents attackers from injecting <base href='https://evil.com'> to redirect relative script imports. |
| upgrade-insecure-requests | upgrade-insecure-requests Instructs user agents to rewrite all insecure HTTP URLs to secure HTTPS URLs before requesting them. upgrade-insecure-requests; | ●upgrade-insecure-requests ↳CSP directive ↳transport policy ↳automatic HTTPS rewriting | W3C CSP3 §6.8.2 Instantly eliminates mixed content warnings on newly migrated HTTPS domains. |
Strict Nonce-Based CSP Policy Template
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-EDNnf03nceEc1hgq' 'strict-dynamic';
style-src 'self' 'nonce-EDNnf03nceEc1hgq';
img-src 'self' data: https:;
font-src 'self' https://fonts.gstatic.com;
connect-src 'self' https://api.example.com;
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
upgrade-insecure-requests;A modern strict policy using nonces and strict-dynamic provides maximum XSS defense while allowing legitimate dynamic script loading.
規格標準 FAQ
Why does my inline script fail even with default-src "self"?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in Content Security Policy (CSP) ディレクティブ完全リファレンス. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]W3CPrimary SpecificationW3C CSP Level 3 • Section 2 & 3Verified Primary SourceTechnical Claim Supported:
Normative specification for Content-Security-Policy HTTP headers, directive fallback inheritance from default-src, and cryptographic nonce/hash-based script execution.
“A server can specify a policy for a resource that the user agent will enforce, restricting the execution of scripts, stylesheets, and embedded frames.”Source URI: https://www.w3.org/TR/CSP3/ - [2]OWASPAuthoritative Security StandardOWASP Cheat Sheet Series • Strict CSP & XSS MitigationVerified Primary SourceTechnical Claim Supported:
Authoritative security guide for strict CSP deployment using per-request cryptographic nonces and strict-dynamic to neutralize Reflected and Stored XSS.
- [3]MDNDeveloper Authority (MDN)MDN Web Docs • CSP Directives ReferenceVerified Primary SourceTechnical Claim Supported:
Reference documentation for browser implementation of CSP directives including script-src, frame-ancestors, object-src, and report-to.
関連技術エコシステムと次の学習ステップ
おすすめの関連開発者ツール
関連技術ガイド
関連技術解説記事
What Is Content Security Policy (CSP)?
Direct definition and directive breakdown of browser-enforced resource restrictions.
What Is Cross-Site Scripting (XSS)?
Detailed analysis of Stored, Reflected, and DOM-based script injection vulnerabilities.
Troubleshooting: Content Security Policy Blocks JavaScript
Resolve Refused to execute inline script errors using nonces and hashes.
関連する技術Q&A
実践ハンズオン診断ラボ
次のステップへ進む
Content Security Policy (CSP) Hands-On Lab
Step into the interactive lab to defend a vulnerable DOM application with strict CSP nonces.