Build a Content-Security-Policy header from allowed sources

This builder turns structured directive rows into one correctly separated header value while catching unknown directive names, duplicates, unsafe separators, and missing values. It is useful when a policy is assembled by a deployment tool, configuration screen, security checklist, or application template and you want predictable output without manually joining fragments or accidentally accepting a misspelled directive.

Describe the policy as directive rows

Enter one row for every policy directive you intend to send. Each row contains the directive name and an ordered list of source expressions or tokens. For example, default-src commonly starts with 'self', while script-src may add a specific HTTPS content delivery host. The builder normalizes directive names to lowercase, trims surrounding space from every source, preserves the order of both rows and sources, and joins the completed directives with semicolons. It does not invent fallback directives or silently broaden a policy. That matters because omission and permission have very different security effects. A missing img-src may fall back to default-src, whereas an extra wildcard can permit more locations than intended. Treat each source as one CSP token; quoted keywords such as 'self' and 'none' must retain their single quotes. Provide schemes such as data: only when the application truly needs them. The result is the complete header value, not the header name, so it can be assigned directly to Content-Security-Policy in your server or edge configuration.

Validation catches structural policy mistakes

The builder accepts only recognized CSP directive names and reports an input error when a name is unknown. This catches easy-to-miss spelling errors that browsers would otherwise ignore, potentially leaving a resource category less restricted than expected. Duplicate directive rows are rejected because browser handling can surprise authors and because a single explicit row is easier to review. Semicolons, commas, line breaks, and embedded whitespace are rejected inside individual source tokens; these characters could accidentally split or corrupt the generated policy. Most directives require at least one source or token. The valueless upgrade-insecure-requests and block-all-mixed-content directives instead require an empty source list and are emitted by name alone. The builder validates structure, not whether a host is trustworthy or whether a policy provides the protection your particular application needs. It also does not fetch a site, inspect code, generate nonces, or test browser compatibility. Review the resulting permissions against actual application behavior, and deploy restrictive policy changes through monitoring and staged environments when breakage would affect users.

Deploy, inspect, and maintain the result

Copy the returned value into the Content-Security-Policy response header. Keep it as configuration alongside the application rather than scattering fragments across middleware, proxy rules, and templates. A centralized list makes additions reviewable and lets automated systems regenerate exactly the same string on every run. Begin with default-src as a deliberate baseline, then add narrower directives such as script-src, style-src, img-src, connect-src, font-src, frame-src, object-src, and frame-ancestors where the application requires different behavior. Prefer explicit hosts and schemes over broad wildcards. If you use hashes or nonces, supply the complete quoted CSP token; nonce creation itself belongs in the request-handling layer because this capability is deterministic and never generates random values. Test the deployed response in browser developer tools and consider a report-only rollout before enforcing a new policy. Browser reports can reveal blocked dependencies, but they should lead to precise policy changes rather than indiscriminate allowances. Re-run the builder whenever configuration changes so validation remains part of the delivery pipeline. API requests cost $0.002, while the browser implementation uses the same pure algorithm.