These 4 new directives provide the functionality of the script/style directive but with more granularity, applying to elements or attributes.

Documentation

• https://w3c.github.io/webappsec-csp/#directive-script-src-attr
• https://w3c.github.io/webappsec-csp/#directive-script-src-elem
• https://w3c.github.io/webappsec-csp/#directive-style-src-attr
• https://w3c.github.io/webappsec-csp/#directive-style-src-elem

Specification

Specification link

Status: Specification being incubated in a Community Group

Status in Chromium

Blink components: Blink>SecurityFeature>ContentSecurityPolicy

Implementation status: Enabled by default (tracking bug)

Consensus & Standardization

• Firefox: No signal
• Edge: No signal
• Safari: No signal
• Web Developers: Positive

Owner

• andypaicu@chromium.org

Intent to Prototype url

Last updated on 2020-11-09