[
  {
    "directive": "child-src",
    "category": "fetch",
    "description": "Controls which URLs may be loaded as nested browsing contexts (<frame>, <iframe>) and as worker scripts. frame-src and worker-src, when present, take precedence for their resource types."
  },
  {
    "directive": "connect-src",
    "category": "fetch",
    "description": "Limits the URLs a page may contact from script, covering fetch(), XMLHttpRequest, WebSocket, EventSource and navigator.sendBeacon()."
  },
  {
    "directive": "default-src",
    "category": "fetch",
    "description": "Fallback source list used for any fetch directive that is not explicitly set in the policy."
  },
  {
    "directive": "font-src",
    "category": "fetch",
    "description": "Limits the URLs from which fonts referenced by CSS @font-face rules may be loaded."
  },
  {
    "directive": "frame-src",
    "category": "fetch",
    "description": "Limits the URLs that may be loaded into <frame> and <iframe> elements."
  },
  {
    "directive": "img-src",
    "category": "fetch",
    "description": "Limits the URLs from which images, including favicons, may be loaded."
  },
  {
    "directive": "manifest-src",
    "category": "fetch",
    "description": "Limits the URLs from which a web application manifest may be loaded."
  },
  {
    "directive": "media-src",
    "category": "fetch",
    "description": "Limits the URLs from which <audio>, <video> and <track> elements may load media."
  },
  {
    "directive": "object-src",
    "category": "fetch",
    "description": "Limits the URLs loaded by <object> and <embed> elements. These legacy plugin elements are best disabled entirely with object-src 'none'."
  },
  {
    "directive": "prefetch-src",
    "category": "fetch",
    "description": "Specifies valid sources to be prefetched or prerendered. Deprecated and removed from CSP Level 3; use the relevant fetch directive instead."
  },
  {
    "directive": "script-src",
    "category": "fetch",
    "description": "Limits where JavaScript and WebAssembly may come from, and governs inline scripts, inline event handlers and eval-like functions through keywords, nonces and hashes."
  },
  {
    "directive": "script-src-attr",
    "category": "fetch",
    "description": "Limits inline event-handler attributes such as onclick. When absent, script-src applies."
  },
  {
    "directive": "script-src-elem",
    "category": "fetch",
    "description": "Limits <script> elements, both inline blocks and external src URLs. When absent, script-src applies."
  },
  {
    "directive": "style-src",
    "category": "fetch",
    "description": "Limits where stylesheets may come from, including <link rel=stylesheet>, inline <style> blocks and style attributes."
  },
  {
    "directive": "style-src-attr",
    "category": "fetch",
    "description": "Limits inline style attributes on individual elements. When absent, style-src applies."
  },
  {
    "directive": "style-src-elem",
    "category": "fetch",
    "description": "Limits <style> elements and <link rel=stylesheet> stylesheets. When absent, style-src applies."
  },
  {
    "directive": "worker-src",
    "category": "fetch",
    "description": "Limits the URLs that may be loaded as Worker, SharedWorker or ServiceWorker scripts. When absent, child-src, then script-src, then default-src applies."
  },
  {
    "directive": "base-uri",
    "category": "document",
    "description": "Limits the URLs that a <base> element may set as the document base URL. It does not inherit from default-src."
  },
  {
    "directive": "sandbox",
    "category": "document",
    "description": "Puts the document in a sandbox like the <iframe> sandbox attribute, optionally re-enabling capabilities with allow-* tokens such as allow-scripts or allow-forms."
  },
  {
    "directive": "form-action",
    "category": "navigation",
    "description": "Limits the URLs that forms in the document may submit to. It does not inherit from default-src."
  },
  {
    "directive": "frame-ancestors",
    "category": "navigation",
    "description": "Limits which origins may embed the document in <frame>, <iframe>, <object> or <embed>, replacing the older X-Frame-Options header. It is ignored when set via a <meta> element."
  },
  {
    "directive": "navigate-to",
    "category": "navigation",
    "description": "Was proposed to restrict the URLs to which the document can initiate navigation (links, forms, window.location, window.open()). Removed from the CSP Level 3 draft in 2022 and never shipped by default in browsers."
  },
  {
    "directive": "report-to",
    "category": "reporting",
    "description": "Names a reporting endpoint (declared with the Reporting-Endpoints header, or the legacy Report-To header) to which violation reports are sent. Supersedes report-uri."
  },
  {
    "directive": "report-uri",
    "category": "reporting",
    "description": "Legacy directive giving a URL to which the browser POSTs CSP violation reports. Deprecated in favour of report-to, but still widely supported."
  },
  {
    "directive": "require-sri-for",
    "category": "other",
    "description": "Would require Subresource Integrity (SRI) for scripts or styles on the page ('script', 'style'). Proposed in an SRI Level 2 draft, never part of CSP Level 3 and not supported by current browsers."
  },
  {
    "directive": "require-trusted-types-for",
    "category": "other",
    "description": "Enables enforcement of Trusted Types for dangerous sink functions (e.g. innerHTML) to prevent DOM XSS. Accepts the value 'script'. Defined in the W3C Trusted Types specification."
  },
  {
    "directive": "trusted-types",
    "category": "other",
    "description": "Defines an allowlist of Trusted Types policy names that may be created with trustedTypes.createPolicy(). Defined in the W3C Trusted Types specification."
  },
  {
    "directive": "upgrade-insecure-requests",
    "category": "other",
    "description": "Makes the browser rewrite the document's http: subresource and navigation URLs to https: before fetching them. Defined in the W3C Upgrade Insecure Requests specification."
  },
  {
    "directive": "webrtc",
    "category": "other",
    "description": "Controls whether the page may establish WebRTC connections; accepts 'allow' or 'block'. Defined in CSP Level 3."
  },
  {
    "directive": "block-all-mixed-content",
    "category": "other",
    "description": "Blocks loading any HTTP resources on an HTTPS page. Deprecated (obsolete): browsers now block or upgrade mixed content by default; use upgrade-insecure-requests instead."
  }
]