Content-Security-Policy Directives

Name: Content-Security-Policy Directives
Creator: staticdata.dev
License: https://opensource.org/licenses/MIT

Every directive defined in the W3C Content Security Policy Level 3 specification — fetch directives that control resource loading (script-src, img-src, connect-src, etc.), document directives (base-uri, sandbox), navigation directives (form-action, frame-ancestors), reporting directives (report-to, report-uri) and webrtc — plus directives from related specifications (upgrade-insecure-requests, the Trusted Types directives) and a few deprecated or abandoned directives still seen in real policies.

v1.0.0 MIT 30 records Updated 2026-10-05 stable Source: W3C Content Security Policy Level 3, MDN Web Docs — Content-Security-Policy

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/csp-directives.json

Or use as a typed import: import { cspDirectives } from "https://staticdata.dev/v1/csp-directives.ts"

Formats

JSON 6.4 KB

/v1/csp-directives.json

Open

min: 5.7 KB · /v1/csp-directives.min.json
CSV 4.5 KB

/v1/csp-directives.csv

Open
TypeScript 6.6 KB

/v1/csp-directives.ts

export const cspDirectives

type CspDirective = (typeof cspDirectives)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
directive	string	The CSP directive token as used in the header value	script-src
category	string	Directive category: fetch, document, navigation, reporting, or other	fetch
description	string	Description of the directive's purpose and semantics	Limits where JavaScript and WebAssembly may come from, and governs inline scripts, inline event handlers and eval-like functions through keywords, nonces and hashes.

Preview

First 10 records.

Data preview
directive	category	description
child-src	fetch	Controls which URLs may be loaded as nested browsing contexts (<frame>, <iframe>) and as worker scripts. frame-src and worker-src, when present, take precedence for their resource types.
connect-src	fetch	Limits the URLs a page may contact from script, covering fetch(), XMLHttpRequest, WebSocket, EventSource and navigator.sendBeacon().
default-src	fetch	Fallback source list used for any fetch directive that is not explicitly set in the policy.
font-src	fetch	Limits the URLs from which fonts referenced by CSS @font-face rules may be loaded.
frame-src	fetch	Limits the URLs that may be loaded into <frame> and <iframe> elements.
img-src	fetch	Limits the URLs from which images, including favicons, may be loaded.
manifest-src	fetch	Limits the URLs from which a web application manifest may be loaded.
media-src	fetch	Limits the URLs from which <audio>, <video> and <track> elements may load media.
object-src	fetch	Limits the URLs loaded by <object> and <embed> elements. These legacy plugin elements are best disabled entirely with object-src 'none'.
prefetch-src	fetch	Specifies valid sources to be prefetched or prerendered. Deprecated and removed from CSP Level 3; use the relevant fetch directive instead.

Showing 10 of 30. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/csp-directives.json | jq '.[0]'

JavaScript

import type { CspDirective } from "https://staticdata.dev/v1/csp-directives.ts";

const res = await fetch("https://staticdata.dev/v1/csp-directives.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const cspDirectives: CspDirective[] = await res.json();
console.log(cspDirectives[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/csp-directives.min.json") as r:
    cspDirectives = json.load(r)

print(cspDirectives[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/csp-directives.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/csp-directives.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The directives in this dataset are curated from the W3C Content Security Policy Level 3 specification. CSP is an HTTP response header that allows site operators to declare approved sources for content types, helping to detect and mitigate certain categories of attacks including Cross-Site Scripting (XSS) and data injection. Each record includes the directive’s canonical token, its functional category, and a concise description of its semantics.

Directives are grouped into five categories. Fetch directives (the largest group) control which URLs are valid sources for various resource types — scripts, styles, images, fonts, workers, and more. Document directives (base-uri, sandbox) restrict the properties of a document’s browsing context. Navigation directives (form-action, frame-ancestors, and the withdrawn navigate-to) restrict the locations a document may navigate to or be embedded within. Reporting directives (report-to, report-uri) configure where violation reports are sent. The other category covers webrtc (CSP Level 3), upgrade-insecure-requests (defined in its own W3C specification) and the Trusted Types directives (require-trusted-types-for, trusted-types, defined in the Trusted Types specification) that address DOM-based XSS.

Deprecated, removed or never-standardised directives (report-uri, prefetch-src, navigate-to, require-sri-for, block-all-mixed-content) are included for completeness because they still appear in real-world policies; their descriptions say so and name the preferred replacement where there is one. The list reflects the CSP Level 3 editor’s draft as of October 2026. Proprietary or browser-specific extensions outside the W3C specification are excluded.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the csp-directives changelog for this dataset's history.