CSP: script-src - [ HTTP 中文开发手册 ] - 在线原生手册

简体中文(ZH-CN) English(EN) 繁体中文(ZH-TW) 日本語(JA) 한국어(KO) Melayu(MS) Français(FR) Deutsch(DE)

ディレクトリ 検索

Guides Access control CORS Authentication Browser detection using the user agent Caching Caching FAQ Compression Conditional requests Connection management in HTTP 1.x Content negotiation Content negotiation: List of default Accept values Cookies CSP Messages Overview Protocol upgrade mechanism Proxy servers and tunneling Proxy servers and tunneling: Proxy Auto-Configuration (PAC) file Public Key Pinning Range requests Redirections Resources and specifications Resources and URIs Response codes Server-Side Access Control Session Guides: Basics Basics of HTTP Choosing between www and non-www URLs Data URIs Evolution of HTTP Identifying resources on the Web MIME Types MIME types: Complete list of MIME types CSP Content-Security-Policy Content-Security-Policy-Report-Only CSP: base-uri CSP: block-all-mixed-content CSP: child-src CSP: connect-src CSP: default-src CSP: font-src CSP: form-action CSP: frame-ancestors CSP: frame-src CSP: img-src CSP: manifest-src CSP: media-src CSP: object-src CSP: plugin-types CSP: referrer CSP: report-uri CSP: require-sri-for CSP: sandbox CSP: script-src CSP: style-src CSP: upgrade-insecure-requests CSP: worker-src Headers Accept Accept-Charset Accept-Encoding Accept-Language Accept-Ranges Access-Control-Allow-Credentials Access-Control-Allow-Headers Access-Control-Allow-Methods Access-Control-Allow-Origin Access-Control-Expose-Headers Access-Control-Max-Age Access-Control-Request-Headers Access-Control-Request-Method Age Allow Authorization Cache-Control Connection Content-Disposition Content-Encoding Content-Language Content-Length Content-Location Content-Range Content-Type Cookie Cookie2 Date DNT ETag Expect Expires Forwarded From Headers Host If-Match If-Modified-Since If-None-Match If-Range If-Unmodified-Since Keep-Alive Large-Allocation Last-Modified Location Origin Pragma Proxy-Authenticate Proxy-Authorization Public-Key-Pins Public-Key-Pins-Report-Only Range Referer Referrer-Policy Retry-After Server Set-Cookie Set-Cookie2 SourceMap Strict-Transport-Security TE Tk Trailer Transfer-Encoding Upgrade-Insecure-Requests User-Agent User-Agent: Firefox Vary Via Warning WWW-Authenticate X-Content-Type-Options X-DNS-Prefetch-Control X-Forwarded-For X-Forwarded-Host X-Forwarded-Proto X-Frame-Options X-XSS-Protection Methods CONNECT DELETE GET HEAD Methods OPTIONS PATCH POST PUT Status 100 Continue 101 Switching Protocols 200 OK 201 Created 202 Accepted 203 Non-Authoritative Information 204 No Content 205 Reset Content 206 Partial Content 300 Multiple Choices 301 Moved Permanently 302 Found 303 See Other 304 Not Modified 307 Temporary Redirect 308 Permanent Redirect 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 405 Method Not Allowed 406 Not Acceptable 407 Proxy Authentication Required 408 Request Timeout 409 Conflict 410 Gone 411 Length Required 412 Precondition Failed 413 Payload Too Large 414 URI Too Long 415 Unsupported Media Type 416 Range Not Satisfiable 417 Expectation Failed 426 Upgrade Required 428 Precondition Required 429 Too Many Requests 431 Request Header Fields Too Large 451 Unavailable For Legal Reasons 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout 505 HTTP Version Not Supported 511 Network Authentication Required Status

テキスト

HTTPContent-Security-Policy（CSP）script-src指令为JavaScript的源指定有效来源。这不仅包括直接加载到


          
           
            请注意，嵌入式事件处理程序也被阻止：
           
          
          
           
            
           
          
          
           
            你应该用addEventListener调用代替：
           
          
          
           
            document.getElementById("btn").addEventListener('click', doSomething);
           
          
          
           
            不安全的内联脚本
           
          
          
           
            注意：禁止内联样式和内联脚本是CSP提供的最大安全胜利之一。但是，如果你绝对必须使用它，有几个机制可以允许它们。
           
          
          
           
            要允许内联脚本和内联事件处理程序，'unsafe-inline'可以指定与内联块匹配的 nonce-source 或 hash-source。
           
          
          
           
            Content-Security-Policy: script-src 'unsafe-inline';
           
          
          
           
            上述内容安全策略将允许内联
           

          

          
           
            您可以使用nonce-source来仅允许特定的内联脚本块：
           
          
          
           
            Content-Security-Policy: script-src 'nonce-2726c7f26c'
           
          
          
           
            您将不得不在
           

          

          
           
            或者，您可以从内联脚本创建散列。CSP支持sha256，sha384和sha512。
           
          
          
           
            Content-Security-Policy: script-src 'sha256-076c8f1ca6979ef156b510a121b69b6265011597557ca2971db5ad5a2743545f'
           
          
          
           
            生成散列时，不要包含
           

          

          
           
            不安全的评估表达式
           
          
          
           
            所述'unsafe-eval'源表达控制该创建从串代码几个脚本执行方法。如果'unsafe-eval'未用script-src指令指定，则以下方法被阻止并不会产生任何影响：
           
          
          
           
            
             eval()
             Function()
             当传递一个字符串文字就像这样的方法：window.setTimeout("alert(\"Hello World!\");", 500);
             
              window.setTimeout
              window.setInterval
              window.setImmediate
             
             window.execScript（IE <11）
            
           
          
          
           
            strict-dynamic
           
          
          
           
            'strict-dynamic'源表达指定明确给出与存在于标记的脚本，通过用随机数或散列伴随它的信任，应当被传播到由根脚本加载的所有脚本。与此同时，任何白名单或源表达式（例如'self'或'unsafe-inline'将被忽略）。例如，一种策略script-src 'strict-dynamic' 'nonce-R4nd0m' https://whitelisted.com/可以允许加载根脚本