Nonce lifecycle
Add a nonce to script-src and a matching nonce attribute on the right scripts. The lab shows which inline blocks survive.
Sandbox
See which payloads your CSP actually blocks.
This page is a teaching tool. The HTML you paste runs only inside a
sandbox="allow-scripts" iframe with a <meta http-equiv="Content-Security-Policy">
tag. It never executes in this page's context and never makes a network request.
Do not paste code that you do not understand. The sandbox is best-effort, not a security boundary.
HTML
CSP
What to try
Patterns the lab is designed to illustrate.
Hashes for static inline
Compute a hash with the Hash tool, paste it into script-src, and the matching inline block runs while any other inline script is rejected.
Third-party scripts
Paste a <script src="https://cdn.example/x.js"> tag and watch what the default-src / script-src allowlist does.
JSONP and eval
A policy without 'unsafe-eval' blocks dynamic code paths. The console of the sandbox iframe tells you exactly which call was refused.
base-uri and form-action
Without base-uri 'self', an injected <base> tag can rewrite every relative URL on the page. Try it.
Reporting vs enforce
The lab enforces by default. Set Content-Security-Policy-Report-Only in the value to see violations without blocking them.
Related reading
Conceptual background and the production fix.
What is CSP
How CSP works at the browser level before trying it here.
Nonce vs hash
Pick the right approach for the payloads you want to allow.
CSP Evaluator
Score the policy the lab runs against.
CSP Generator
Author a stricter policy to paste back into the lab.
CSP Hash Generator
Compute the hash for an inline block, then drop it into the lab.
CSP Checker
When you are ready to ship, verify the real response header from a live site.