Content Security Policy Parser

Parse one serialized CSP policy into lowercase directive names and source tokens, keeping the first occurrence of each directive.

Description

A serialized Content Security Policy contains semicolon-separated directives with whitespace-separated values.

A serialized Content Security Policy contains semicolon-separated directives with whitespace-separated values. Effective browser enforcement requires more than reading that syntax.^[1]

Parse one serialized CSP policy into lowercase directive names and source tokens, keeping the first occurrence of each directive.

When to use Content Security Policy Parser

Use this tool to parse one serialized CSP policy into lowercase directive names and source tokens, keeping the first occurrence of each directive.

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.

How to use Content Security Policy Parser and understand its results

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.
Enter policy using the field table and calculation rules, then run the tool.
Read directives. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
policy	One Content-Security-Policy field policy.	string; maximum length: 1000000	Required

Paste one policy field value. Require ASCII header characters, split semicolons and tokenize spaces/tabs. Validate directive-name characters, lowercase each name and retain the first occurrence when repeated. Return ordered names and value lists, including empty lists.

directives=first occurrence of each lowercased directive name with following tokens

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
directives	Directives in source order.	list of object; minimum entries: 0; maximum entries: 100000

json

{
  "input": {
    "policy": "default-src 'self'; IMG-SRC https: data:; img-src 'none'"
  },
  "output": {
    "directives": [
      {
        "name": "default-src",
        "values": [
          "'self'"
        ]
      },
      {
        "name": "img-src",
        "values": [
          "https:",
          "data:"
        ]
      }
    ]
  }
}

Limitations and assumptions

Unknown directives and source expressions are not semantically validated. This does not evaluate effective restrictions, merge multiple policies, compare report-only behavior or establish that a page is secure.

Numeric inputs must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Extremely large text inputs are rejected. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.

Alternative or Complementary methods

Use Permissions Policy Parser: Parse feature allowlists from Permissions-Policy dictionary syntax, supporting wildcard, self, and quoted origins without evaluating permissions. For a complementary task, use URL Origin: Extract the origin of an absolute URL using the WHATWG URL parser, including its normalization rules.

References

Content Security Policy Parser — tool.io

Similar or alternative tools

Permissions Policy Parser
Parse feature allowlists from Permissions-Policy dictionary syntax, supporting wildcard, self, and quoted origins without evaluating permissions.
URL Origin
Extract the origin of an absolute URL using the WHATWG URL parser, including its normalization rules.